TopicActive Directory →
Simple definition
A mechanism for a service to use the identity of a user to another service.
Technical definition
The Delegation Kerberos allows an intermediate server to present tickets in the user’s name according to the rights set.
What is it used for ?
Solve some double-hop scenarios.
Practical example
A web application can access SQL in the name of the connected user.
Common issues
- Delegation too broad
- SPN incorrect
- Risk of increased privileges
Related terms
SPN · Constrained Delegation · Kerberos
Key takeaway: Exact behavior and commands may vary depending on versions, products and architectures.