I've created a new project for PAC-less constrained delegation in the MIT KDC: http://k5wiki.kerberos.org/wiki/Projects/ConstrainedDelegation Prior to this, the constrained delegation support we shipped in the 1.7 KDC was only useful with a backend that validated the Windows PAC, such as DSfW. -- Luke -- www.padl.com | www.fghr.net