competition-kerberos-delegation

To trace a Kerberos delegation chain, you map the path from the source principal through the delegation edge to the accepting service, verifying the exact ticket type, SPN, and PAC data that actually grants privilege.

Constrained delegation limits which services a principal can impersonate, unconstrained allows forwarding TGTs anywhere, and resource-based delegation configures the accepting service itself to trust principals for impersonation.

You document a replayable chain by capturing and preserving ticket minting details such as encryption type, cache location, SPN, delegation mode, and the accepting service that ultimately validates the token.

Yes, separating token minting from actual service acceptance is the core problem it solves, identifying the exact delegation edge and verifying which accepting service actually validates the resulting privilege.

Yes, you can apply this to audit S4U and SPN trust relationships within sandboxed or real-domain environments, capturing the exact delegation configurations and verifying the resulting privileged access.

When auditing delegation edges, you need to capture ticket details including TGT or TGS status, encryption type, PAC and group data, cache location, and the specific accepting service to produce a complete evidence chain.