Looking at network traces, you may see errors such as KRB Error: KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN. If the AD FS service account has a misconfigured or the wrong SPN then this can cause issues. The browser will get a Kerberos ticket for the AD FS service account.Active Directory tells the browser that it's the AD FS service account.A web browser queries Active Directory to determine which service account is running.This allows a client application to request that the service authenticate an account even if the client doesn't have the account name.Īn example of an how an SPN is used with AD FS is as follows:

SPNs are used by Kerberos authentication to associate a service instance with a service logon account. Internet Explorer configuration SPN misconfigurationĪ service principal name (SPN) is a unique identifier of a service instance. Service Principal Name(SPN) misconfiguration There are three main reasons why integrated windows authentication will fail.

Reason integrated windows authentication fails Integrated Windows authentication enables users to log in with their Windows credentials and experience single-sign on (SSO), using Kerberos or NTLM.

Firefox os x troubleshooting