Web Application Proxy 2025 strange behavior

Question

Hi,

I added to ADFS 2022 farm ADFS 2025 server and WAP 2025 server.

I added existing SPNs to WAP 2025 Delegation tab

Apps published without PreAuth work.

Apps published with PreAuth throw 500 and event log logs errors 13019 and 12027 on WAP 2025 (access to apps through WAP 2022 works fine).
But if I access apps with PreAuth through WAP 2025 with admin account then it works (other user accounts do not work).

I checked probably everything multiple times.

What am I missing?

Thank you,

Richard

Answer 1

It's 2025.

But adding WAP server computer account to "Pre-Windows 2000 Compatible Access" group still helps to resolve ADFS -> WAP Kerberos communication. Don't forget to reboot WAP server.

Without this you get misleading error:
Web Application Proxy cannot retrieve a Kerberos ticket on behalf of the user because of the following general API error: The user name or password is incorrect.

HTH

Answer 2

Klist sessions on ADFS server show session for user trying to access PreAuth app.

Klist sessions on WAP 2025 server does not show session for user trying to access PreAuth app. Security event log shows event 4625 0xC0000064, caller process AppProxy.exe

Looks like communication between ADFS server and WAP 2025 is somehow broken for most of user accounts (2 users account with admin privilege have no problem).