TopicActive Directory →
Simple definition
One delegation Kerberos limited to explicitly authorized services.
Technical definition
Kerberos Constrained Delegation restricts the services to which an account may delegate the identity of a user.
What is it used for ?
Reduce risk compared to non-binding delegation.
Practical example
A web server may be allowed to delegate only to a specific SQL service.
Common issues
- Target service forgotten
- SPN incorrect
- Unreviewed inherited configuration
Related terms
Kerberos Delegation · SPN · Myth of privilege
Key takeaway: Exact behavior and commands may vary depending on versions, products and architectures.