Entra joined device does not receive Kerberos ticket for "custom" SPN

Philipp Näther 20

Hi everyone,

I am currently trying to make our mail system's (not Outlook) SSO work with an Azure/Entra joined device. So the device is not domain joined, it is only Entra joined. But has line of sight to the on prem domain controllers so it actually receives the Kerberos TGT of the on prem DC and for example the ticket for the ldap service of the DC. But the problem is, the client does not receive the Kerberos ticket for the mail system SPN while being only Entra joined. If I join the device to the onprem AD, everything works fine, the ticket for the mail system gets granted and I am able to login seamlessly.

Does anyone have an idea or experience what can be done here?

Regards,

Philipp

PS: The reason behind going the Entra way is I want to implement a way for our users to work in office and mobile / in home office as seamlessly as possible.

Akhilesh 4,775 Reputation points Microsoft Vendor

2024-03-27T11:53:12.6866667+00:00

Hi @Philipp Näther

Since you are receiving the ticket from on-prem DC and the device is Entra joined, to enable SSO for your mail system on an Entra joined device you need to ensure that your on-premises identity information is synchronized to Entra ID using Entra Connect or Entra cloud sync. May I know is your on-prem Active Directory is synchronized to Entra ID?
Philipp Näther 20 Reputation points

2024-03-27T13:45:19.29+00:00

Hi Akhilesh,

yes, the on prem AD is synced via Entra Connect.
In another forum a user said I should try Cloud Kerberos Trust.
After searching for a HowTo, it looks like I need Intune to deploy Windows Hello for Business to establish Cloud Kerberos Trust. My problem there is that we do not have Intune / Endpoint Manager licensed...
Philipp Näther 20 Reputation points

2024-03-27T17:03:06.2766667+00:00

I realized I did not need Intune to deploy Cloud Kerberos Trust.

I followed the MS docs: https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/deploy/hybrid-cloud-kerberos-trust?tabs=intune

I have one question here: Do the objects created in this step https://learn.microsoft.com/en-us/entra/identity/authentication/howto-authentication-passwordless-security-key-on-premises#install-the-azureadhybridauthenticationmanagement-module also have to be created in the Entra Tenant? Or is it just for on-prem?

Checking dsregcmd /status on the device now shows me in the SSO state section:

OnPremTgt : YES
CloudTgt : YES

Does this mean the cloud kerberos trust works correctly?

I still get no kerberos ticket for our mail system tho...

Accepted answer

Givary-MSFT 27,966 Reputation points Microsoft Employee

2024-03-28T05:23:45.4733333+00:00
Hi @Philipp Näther taking over from Akhilesh, could you help me with the below details:

Provide more info on the mail application which is being accessed.

When you access the mail application from on-premise domain joined device, share the output of klist and dsregcmd /status

When you access the mail application from entra joined device, share the output of klist and dsregcmd /status

Was this setup working before?

How did you configure SSO?

Also, what happens when you access myapps.microsoft.com from the entra joined device, does the user experience seamless sso?
Please sign in to rate this answer.
Philipp Näther 20 Reputation points

2024-03-28T14:23:58.16+00:00

Hi Givary,

The mail system is OpenText GroupWise (formerly MicroFocus/Novell) running on a linux server.

klist and dsregcmd from on-prem

klist and dsregcmd from Entra joined

The setup never worked with the Entra joined device I am testing with. Same device works if on-prem AD joined.

The setup never worked with the Entra joined device I am testing with. Same device works if on-prem AD joined.

Could you specify this question please?

Accessing myapps.microsoft.com with the Entra joined device first shows "Continue with Login?"-dialogue. After clicking next I am logged in to the website. So it seems pretty seamless to me. :D PS: I currently have a discussion open in the community forum of the mail system vendor aswell. Unfortunately I only received one answer yet which led me to cloud kerberos trust without success.

Givary-MSFT 27,966 Reputation points Microsoft Employee

2024-03-28T16:19:50.58+00:00

@Philipp Näther Thank you for sharing the logs, due to PII details, I have copied the logs at my end and deleted from the QnA portal.

Let me review them and revert back.

Philipp Näther 20 Reputation points

2024-04-02T14:00:59.1033333+00:00

@Givary-MSFT Hi Givary, you got any update on this?

Philipp Näther 20 Reputation points

2024-04-02T14:42:43.1333333+00:00

I just found out that the device is actually able to manually receive a Kerberos ticket for the mail system specific SPN if I run the command

klist get groupwise/server.my.domain.com

Yet SSO still does not work and I get prompted for a password when trying to start the mail application even with the received Kerberos ticket. So I guess it is a problem on the mail system/application side.

Givary-MSFT 27,966 Reputation points Microsoft Employee

2024-04-10T07:12:23.04+00:00

@Philipp Näther Apologies for the delayed response, even after getting SPN, SSO is not working, would recommend to check with application vendor whether it supports SSO functionality or not.

Philipp Näther 20 Reputation points

2024-04-10T07:47:03.3766667+00:00

@Givary-MSFT Yeah, the vendor confirmed the application actually does not support SSO on Entra joined device. I added a feature request. Thanks for the help!

Givary-MSFT 27,966 Reputation points Microsoft Employee

2024-04-10T07:52:23.4433333+00:00

@Philipp Näther Thanks for the update, please remember to "Accept Answer" if answer helped, so that others in the community facing similar issues can easily find the solution.
Sign in to comment

Entra joined device does not receive Kerberos ticket for "custom" SPN

0 additional answers