> Source: [sk114555](https://support.checkpoint.com/results/sk/sk114555)

# sk114555 - SSO Kerberos Authentication is not triggered in Mobile Access Web Application when 'SPNegoTokenRequested' header is being sent by the internal Web Server

| Property | Value |
|----------|-------|
| Solution ID | sk114555 |
| Date Created | 2016-11-16 |
| Last Modified | 2020-11-12 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |
| OS | Gaia |

## Symptoms

- * SSO Kerberos Authentication is not triggered in Mobile Access Web Application when the following http headers are being sent from the Web Server:  
  `set-cookie: SPNegoTokenRequested & set-cookie: sap-usercontext`
* The internal web server is SAP NetWeaver Application, and has a preference for HTTP authentication and in case it fails is will display a web form for manual authentication.
* The Security Gateway is not triggering a request for a ticket from the Active Directory.
* After a few milliseconds a web form is shown asking for manual authentication.

## Cause

The Mobile Access Gateway attempts to connect with the `'SPNegoTokenRequested'` token and is not sending the next HTTP packet with the Kerberos ticket.  
The web server expects that the next received request to be sent with the Kerberos ticket, and since the ticket was not sent, the web server assumes we cannot perform Kerberos authentication, and displays a web form.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content