IT Toolbox
Menu
Français
HomeIT DictionaryConstrained Delegation
IT dictionary

Constrained Delegation

One delegation Kerberos limited to explicitly authorized services.

TopicIT knowledge → About 1 min read

Simple definition

One delegation Kerberos limited to explicitly authorized services.

Technical definition

Kerberos Constrained Delegation restricts the services to which an account may delegate the identity of a user.

What is it used for ?

Reduce risk compared to non-binding delegation.

Practical example

A web server may be allowed to delegate only to a specific SQL service.

Common issues

  • Target service forgotten
  • SPN incorrect
  • Unreviewed inherited configuration

Key takeaway: Exact behavior and commands may vary depending on versions, products and architectures.

Related resources

Relevant topic Kerberos Delegation A mechanism for a service to use the identity of a user to another service. Relevant topic SPN One SPN (Main Name Service) is an identifier used by Kerberos to associate a network service with the Active Direct... Relevant topic Least Privilege The principle of giving only the necessary rights for the necessary period. Relevant topic Kerberos Constrained Delegation The forced delegation Kerberos limits the services to which an identity may delegate authentication. Relevant topic Resource-Based Constrained Delegation RBCD allows the target service to define which identities can be delegated to it.
Support the development of BAOI Hosting, domains and new IT resources.
❤️ Support BAOI

My favorites