KB - Network analysis for back-side Kerberos SSO

Affects product

  • Airlock Gateway

Question or problem

Although everything seems to be configured correctly, Back-side Kerberos SSO does not work. A deeper analysis of the network is required to see which packets are sent and received by Airlock Gateway.

Procedure-related prerequisites

  • You need to be logged in as root on the Airlock Gateway console.

Instruction

Test preparation:

  1. Record a tcpdump on Airlock Gateway containing the following traffic:
    • Kerberos (port 88) from and to the Active Directory domain controllers.
    • HTTP and HTTPS from and to the back-end server.
  3.  
    Info

    The article Traffic tracing with tcpdump / TShark / Wireshark describes how to record a tcpdump on Airlock Gateway.

    Ensure that Airlock Gateway is configured to record the SSL keys as well, in order to decrypt the SSL/TLS traffic later on. Otherwise, an analysis might be impossible.

Test execution and verification:

  1. Open the recorded tcpdump in Wireshark.
  2. Configure Wireshark to use the SSL key log file to decrypt the traffic.
  3. Verify the following:
    • The HTTP request sent to the backend contains a Kerberos ticket for the correct SPN.
    • The HTTP request sent to the backend contains the correct host header.
    • There are no obvious Kerberos problems in the tcpdump.
    • Search in Airlock Gateway for suspicious log entries. Match them by using the WR-SG-CONNTRACE log message to the corresponding packets in the tcpdump.
  5. The verification steps from the above were successful.
 
Info

Kerberos packets with the error code KRB5KRB_ERR_GENERIC can be observed in the tcpdump and may indicate a time synchronization issue.