Okta Access Gateway (OAG) generates a 401 error when a user attempts to access an Internet Information Services (IIS) application because the authentication header name is incorrect. Administrators must change the header attribute name to iwa_username in the OAG application settings to resolve the issue. This issue assumes the Kerberos realm is valid and the Kerberos simulator is successful.

Okta displays the following error when a user attempts to access the application:

401 - Unauthorized: Access is denied due to invalid credentials.

 

Okta generates the following log entries when this error occurs:

Server not found in Kerberos database.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta Access Gateway (OAG)
• Kerberos
• Internet Information Services (IIS) Application

Okta Access Gateway requires the authentication header name to be exactly iwa_username.

The following image displays the correct header configuration.
 

If an administrator configures a different header name, Okta cannot request the Kerberos ticket from the Key Distribution Center (KDC). The KDC rejects the Kerberos ticket request and generates a KDC_ERR_C_PRINCIPAL_UNKNOWN error.

The following packet capture image displays the KDC rejection error.
 

How is the Okta Access Gateway Kerberos application 401 error resolved?

Resolve the 401 error by configuring the header attribute name to iwa_username in the Okta Access Gateway application settings by following these steps.

1. Navigate to the Okta Access Gateway application settings.
2. Locate the header attribute used for authentication.
3. Change the name of the header attribute to iwa_username.
4. Save the configuration.

Related References

• Add Kerberos service
• Kerberos application troubleshooting and best practices