- Directories
- Agentless DSSO
In some cases, when the ADSSO Service Account is created and the SPN is set without the correct AES encryption settings on the service account, just correcting the AES encryption settings will not automatically resolve the issue.
If the AES is enabled on the ADSSO SPN service account that generates the Kerberos tokens and finds that the tokens are still being issued with RC4 encryption, the ADSSO SPN service account password may need to be reset manually. This is because the account password does not automatically rotate, and the current password may have been set previously when AES key generation was not supported.
Once the password is reset in Active Directory, validate the service account password under Security > Delegated Authentication > Agentless Desktop SSO in the Okta Admin Console.
