Application Proxy is throwing an error when Authenticating against AD, I'm not using ADFS it is Azured Managed Hybrid setup

Question

Application Proxy is throwing an error when Authenticating against AD, I'm not using ADFS it is Azured Managed Hybrid setup

Alban 0

I'm receiving this error from Application Proxy,

Incorrect Kerberos constrained delegation configuration in your on-premises Active Directory.

THe Logs in the Azure Proxy servers are showing the errors below:

Error: 12027

Web Application Proxy encountered an unexpected error while processing the request.

Error: No credentials are available in the security package

(0x8009030e)

Bhasker Donthu 950 Reputation points Microsoft External Staff

2024-11-25T13:22:51.6266667+00:00
Hello @Alban,

Thank you for posting your query on Microsoft Q&A.

understood that you’re encountering two primary issues related to Kerberos constrained delegation and Web Application Proxy. The errors, specifically "Incorrect Kerberos constrained delegation configuration in your on-premises Active Directory" and "No credentials are available in the security package (0x8009030e)," indicate potential misconfigurations in the Kerberos delegation setup.

Here are few steps for troubleshoot the issue:

1. Kerberos Constrained Delegation Configuration

Ensure that your Kerberos constrained delegation is correctly configured in your on-premises Active Directory. Here are some key steps:

Service Principal Names (SPNs): Verify that the SPNs are correctly set for the service accounts involved. You can use the setspn command to check and set SPNs.

Delegation Settings: Open Active Directory Users and Computers (ADUC).

Navigate to the service account or the computer account for the Web Application Proxy server.

Under the Delegation tab, ensure the following options are selected:

Trust this user/computer for delegation to specified services only.

Use Kerberos only

For more details please refer: https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/configure-kerberos-constrained-delegation

2. Web Application Proxy Error 12027 This error indicates an issue with the Web Application Proxy configuration. Here are the few steps to troubleshoot:

·       Ensure that the Web Application Proxy server is joined to the same domain as the domain controller

·       Verify that the Web Application Proxy can communicate with the AD FS server. Check the connectivity and ensure that the trust relationship is intact

·       Check the Event Viewer on the Web Application Proxy server for more detailed error messages under Applications and Services Logs > Microsoft > Windows > Web Application Proxy > Admin

For more details on web application proxy troubleshoot, please refer below links. https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/troubleshoot-web-application-proxy

https://learn.microsoft.com/en-us/entra/identity/app-proxy/application-proxy-troubleshoot

For better solution, could you please provide the following details 1.Screenshots of the configuration settings.

2.Details about your setup (e.g., backend application type, service accounts used, and SPN details).

3.Relevant Event Viewer logs.

I hope this information is helpful. Please feel free to reach out if you have any further questions.

Share via

Application Proxy is throwing an error when Authenticating against AD, I'm not using ADFS it is Azured Managed Hybrid setup

Your answer