PingOne

Troubleshooting Kerberos authentication

I am unable to sign on using Kerberos through the PingOne gateway

If you’ve configured the PingOne gateway to support Kerberos authentication, but you’re still seeing a sign-on screen, check the audit logs for any Kerberos failures.

You can find a complete list of events logged in PingOne in Audit Reporting Events in the PingOne API documentation.

{
  "id": "f0509c78-9d00-4c69-92e0-6528d7cd5494",
  "code": "ACCESS_FAILED",
  "message": "The request could not be completed. You do not have access to this resource.",
  "details": [
    {
      "code": "INVALID_TOKEN",
      "message": "Kerberos ticket is invalid"
    }
  ]
}

The Kerberos ticket is invalid error indicates the browser submitted a Kerberos ticket, but the ticket was invalid or otherwise unable to be processed.

This error occurs when:

The KDC isn’t issuing tickets with AES encryption

  1. In Windows, open a command prompt and enter klist.

    There should be a ticket for the services for which you configured SPNs. For example, HTTP/kerberos.pingone.com and HTTP/d3vol3lyj0eg62.cloudfront.net.

    Learn more in Creating SPNs.

  2. Check the KerbTicket Encryption Type.

    If the KerbTicket Encryption Type is set to RSADSI RC4-HMAC, it will not be supported by PingOne, as PingOne requires AES encryption.

    1. On your server, in Active Directory Users and Computers, find the user account that is attempting to access PingOne using Kerberos.

    2. Right click the account and select Properties.

    3. Click the Account tab.

    4. In the Account Options section, select This account supports Kerberos AES 256 bit encryption.

    If there is a login error, you might need to purge existing Kerberos tickets.

  3. To purge tickets:

    1. Open a command prompt and enter klist purge.

    2. Sign off from Windows and sign back on.

    3. Attempt Kerberos authentication.

Discuss the best way to ensure that the Key Distribution Center (KDC) issues tickets using AES encryption for all users with your Active Directory (AD) admin.

The service account for the PingOne gateway isn’t configured to use AES encryption for Kerberos

  1. On a Windows-based computer, open Active Directory Users and Computers and locate the service account you configured for the PingOne LDAP gateway Kerberos integration.

  2. Right-click the service account and click Properties.

  3. On the Account tab, in the Account Options section, select the This account supports Kerberos AES 256 bit encryption checkbox.

  4. Restart the gateway instance.

    Learn more in Starting a gateway instance.

  5. Confirm that Kerberos authentication is working.

  6. If Kerberos authentication still isn’t working, purge existing Kerberos tickets:

    1. Open a command prompt and enter klist purge.

    2. Sign off from Windows and sign back on.

    3. Attempt Kerberos authentication.

  7. If Kerberos authentication still isn’t working after purging existing Kerberos tickets, reset the password for the service account and purge existing Kerberos tickets again.

A user consistently receives HTTP error 413 or 431

Kerberos tickets contain user group information that can exceed the PingOne header size limit. This is especially true for users who are members of many groups. These users might experience the following errors:

  • HTTP error 413: Content Too Large

  • HTTP error 431: Request Header Fields Too Large

  • HTTP errors 400, 492, and 502: various additional errors

The PingOne platform limit is different depending on whether the environment is configured to use a Cloudflare-based custom domain.

The PingOne environment isn’t configured for Cloudflare

Some users might experience HTTP errors 400, 413, 431, 494, or 502 when their browser sends a large Kerberos header. This could indicate that the environment isn’t properly configured to use the Cloudflare-based custom domain for Kerberos authentication.

To resolve this issue:

The platform limit for environments that aren’t configured for Cloudflare-based custom domains is 6 KB.

The PingOne environment is configured for Cloudflare

If the environment is properly configured with a Cloudflare-based custom domain, users still might experience HTTP 431 Request Header Fields Too Large if the Kerberos header exceeds the 64 KB limit. For example:

{
  "code": "INVALID_DATA",
  "message": "The request could not be completed. One or more validation errors were in the request.",
  "details": [
    {
      "code": "SIZE_LIMIT_EXCEEDED",
      "message": "A header value exceeds a maximum character limit.",
      "target": "Authorization",
      "innerError": {
        "limit": 65536
      }
    }
  ]
}

To fix this, reduce the number of groups the user is a member of so that the Kerberos ticket is smaller.

The platform limit for environments using Cloudflare-based custom domains is 64 KB.

It’s also possible for users to experience HTTP 431 Request Header Fields Too Large if the other header values exceed the 6 KB limit. For example:

{
  "code": "INVALID_DATA",
  "message": "The request could not be completed. One or more validation errors were in the request.",
  "details": [
    {
      "code": "SIZE_LIMIT_EXCEEDED",
      "message": "The combined size (name and values) of headers exceeds a maximum character limit.",
      "target": null,
      "innerError": {
        "limit": 6144,
        "size": 7558
      }
    }
  ]
}

Inspect the requests in order to determine which large headers are contributing to the error. If browser cookies are contributing to the errors, consider changing cookie architecture or adding infrastructure in order to limit or strip cookies that are unnecessary for authentication flows.

The user consistently receives HTTP error 401

In some cases, the browser receives the initial 401 Unauthorized negotiation challenge but doesn’t respond with the Kerberos negotiation response. This can happen when Windows isn’t configured to send larger Kerberos headers. Learn more about problems with Kerberos authentication when a user belongs to many groups in the Microsoft documentation.