Definition
Kerberos constrained delegation permits a service to delegate a user's identity only to explicitly approved destination services.
How it works
Allowed targets are identified through SPNs. Modes with and without protocol transition have different requirements and risks; misconfiguration can create access failures or excessive service authority.
Real-world example
A web frontend accesses SQL Server on behalf of a user without unconstrained delegation to every service in the domain.
Limits and best practices
Limit SPNs and delegated principals, audit changes, protect sensitive identities and test double-hop scenarios.
Technical detail to remember
In a double-hop scenario, a frontend must access a downstream service using the user's identity. Check SPNs, delegation configuration, possible protocol transition and protected account restrictions before modifying permissions.