Return
-
Title
Using Microsoft ISA proxy server and trying to get Single Sign On to work with MAC OS X -
Description
A Microsoft ISA proxy server is between the client machine and the internet and Single Sign On does not work with MAC OS X.
-
Cause
OS X Safari does not support Keberos GSSAPI and SSO fails.
-
Resolution
First Step is that Firefox can be used as an alternative to Safari.
The Quest Authentication Services kerberos ticket needs to be proxiable and no-addresses set. This can be done by setting the following parameters in /etc/opt/quest/vas/vas.conf.
[libdefaults]
no-addresses = true
proxiable = true
These can be set manually in vas.conf, in a group policy or by running the following commands.
# /opt/quest/bin/vastool configure vas libdefaults proxiable true
# /opt/quest/bin/vastool configure vas libdefaults no-addresses true