[EXTERNAL] Re: Kerberos Constrained Delegation and Credential Caching

[Greg Hudson]

On 03/14/2013 01:12 PM, Nebergall, Christopher wrote:
> I used git-bisect to track down the first commit where t_s4u test program fails running against Windows 2008 R2 SP 1.   How do I disable fast support for testing?  Or I can help reduce the test case further if someone can tell me where to start.

Thanks for tracking down the relevant change.  I don't think we have a
user-accessible switch to turn off FAST TGS.  In principle you could
modify the ccache so that the client doesn't think the KDC supports
FAST, but that would involve writing code and probably isn't worth the
effort.  Alternatively, you could step through the code and

It can be tough to debug an interop problem, but Wireshark traces from
before and after the FAST TGS change could be useful.