Background:
- Web server running LAMP stack
- Web server has VPN tunnel to AD network at HQ
- Multiple AD networks around the globe with VPN tunnels and trust relationships to HQ network
- Kerberos authentication configured on webserver and working for all networks using keytab files
- I am the web administrator but have no access to any of the AD network configurations
We have a problem with one AD network that only manifests with IE or Chrome when the PC used to access our web server is bound to the AD in question. No token is passed and there are no entries in the server logs related to token negotiation. If we use Firefox and enable the network.negotiate-auth options then the user is able to log in without issue however they get an authorisation required error when using IE. The web site is in the intranet zone and IWA is checked (this is controlled by the GPO)
If the users try to access the site with IE or Chrome from outside of their AD they get presented with the expected authentication login prompt and a token then gets sent properly.
I have spoken to the network administrators and they are certain that there is no special configuration required for AD to ensure Kerberos authentication works but I cannot understand why authentication works for six other AD networks and fails for this 1 if it isn't down to the AD configuration itself.
Am I missing something? What could explain the failure to negotiate a token?
[Note - this is not urgent, and as I am leaving the office now will answer any requests for more details on Monday]