WebLogic Server Fails to Authenticate a Client Via Kerberos Protocol When Authentication Is Delegated to Citrix Netscaler (Doc ID 1933634.1)

Last updated on DECEMBER 16, 2023

Applies to:

Symptoms

In this scenario, a Negotiate Identity provider has been configured in WebLogic Server as per the doc "Configuring Single Sign-On with Microsoft Clients".

Everything works fine when using MS Internet explorer, or other browsers on client computers in Microsoft domain. The problem came when one tries to configure Citrix Netscaler appliance to delegate the Kerberos authentication, typically for external users connecting from Internet from computers which are not in Microsoft domain. The Netscaler correctly authenticates the user, then sends a Kerberos ticket to WebLogic Server, but WebLogic Server is unable to parse it.

These are the entries in WebLogic Server logs showing the issue:

Cause

My Oracle Support provides customers with access to over a million knowledge articles and a vibrant support community of peers and Oracle experts.