ACL for Constrained Delegation?

[Rick van Rein]

Hello,

I’m trying to understand how to configure Constrained Delegation in the KDC.  I think I got the GSSAPI client side part, notably S4U2Proxy, but I can only seem to find proxy / proxiable flags in the KDC setup.  And these don’t have undisputably clear semantics, from what I’ve read.

Let’s say I want to setup webmail.example.com with permissions to access LDAP, IMAP and SMTP; however, sendmail.example.com can only access SMTP and contacts.example.com can only access LDAP; schematically:

HTTP/webmail.example.com  —>  ldap/ldap.example.com
HTTP/webmail.example.com  —>  imap/imap.example.com
HTTP/webmail.example.com  —>  smtp/smtp.example.com
HTTP/sendmail.example.com  —>  smtp/smtp.example.com
HTTP/contacts.example.com  —>  ldap/ldap.example.com

How would I setup these delegations, and only these delegations, with MIT Kerberos5?

Thanks!
 -Rick