MS-SFU errata changed KDC order of precedence of constrained-delegation

Isaac Boukris iboukris at
Sun Jan 26 08:21:24 EST 2020

Hi Greg,

I noticed an update changing the order to prefer
ServicesAllowedToSendForwardedTicketsTo over
ServicesAllowedToReceiveForwardedTicketsFrom, which means the KDC
prefers legacy-cd over RBCD.

I'm not clear what the impact is, maybe the returned error in some
cases, but I think we should probably change accordingly.


More information about the krbdev mailing list