When I try to register a new agent or even start a pre-registered agent while the Windows Negotiate SSO plugin is active, the agent reports the following error. The agent is configured to use "Launch agent by connecting it to the controller".

C:\Jenkins2>SET JAVA_HOME=C:\Jenkins\jdk-11.0.9.1+1-jre
C:\Jenkins2>"C:\Jenkins\jdk-11.0.9.1+1-jre\bin\java.exe" -jar agent.jar -jnlpUrl http://JENKINS-URL:8085/computer/AGENT-NAME/jenkins-agent.jnlp -secret MY_SECRET -workDir "C:\Jenkins2"
Nov. 03, 2022 9:45:31 VORM. org.jenkinsci.remoting.engine.WorkDirManager initializeWorkDir
INFO: Using C:\Jenkins2\remoting as a remoting work directory
Nov. 03, 2022 9:45:31 VORM. org.jenkinsci.remoting.engine.WorkDirManager setupLogging
INFO: Both error and output logs will be printed to C:\Jenkins2\remoting
Failed to obtain http://JENKINS-URL.dspace.de:8085/computer/AGENT-NAME/jenkins-agent.jnlp?encrypt=true
java.io.IOException: Failed to load http://JENKINS-URL.dspace.de:8085/computer/AGENT-NAME/jenkins-agent.jnlp?encrypt=true: 500 Server Error
        at hudson.remoting.Launcher.parseJnlpArguments(Launcher.java:514)
        at hudson.remoting.Launcher.run(Launcher.java:346)
        at hudson.remoting.Launcher.main(Launcher.java:297)

When I deactivate the plugin, restart the Jenkins server and register/run the agent, it starts up just fine. I can then re-activate the plugin, restart the server and the (still running) agent reconnects. But once I restart the agent with activated plugin, it again fails to start up.

Anyhow, we must use the SSO plugin since we have a 2-factor authentication, i.e., the standard Jenkins login does not work for us

Our longer existing agents that have been registered using "Java Web Start" are still working fine. Unfortunately, this option is no longer available with Java 11.

PS: Even older Jenkins versions have shown this issue.

A fix would be highly appreciated!