In our large corporate environment we have 4 ISA 2006 servers set up. The users (WinXP IE8) are configured with an automatic proxy configuration script. Recently, the PAC was modified to return FQDN instead of IP addresses of the ISA servers. This was done to force Kerberos authentication instead of NTLM.
The change has been causing intermittent problems for some users. When accessing sites over SSL, they get multiple prompts for authentication from the proxy server. Not all users are affected. Different sites are affected. At one point, one of the proxy servers started spewing out a "502 Proxy Error. No buffer space is supported." It was rebooted and was back in business.
The best we can figure is that it has to do with the large Kerberos token size (we are a big operation with hundreds/thousands of AD security groups).
Some of users have MaxPacketSize and MaxTokenSize configured for Kerberos. Some don't. The two problem users I looked at both had these settings.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters] "MaxPacketSize"=dword:00000001 "MaxTokenSize"=dword:0000ffff
Rolling back the PAC to use IP addresses (and NTLM) resolves the problem for the users. But the proxy admins still want Kerberos for these reasons: Why use Kerberos instead of NTLM in IIS?.
Will pushing out these registry settings to all users fix the problem, or are these settings the root of the problem?
Is there a setting on the ISA server that needs to be adjusted to match the token size settings on the desktops?