Kerberos relaying

Kerberos relaying forwards authentication material to a service that accepts the relayed identity without establishing that the relay is the intended client. The exact path is protocol- and target-specific. AS-REQ and TGS-REQ are requests to a KDC, not generic service-authentication requests to intercept. The example below documents only KrbRelayUp's RBCD-over-LDAP relay phase: it changes a target computer object's resource-based constrained delegation setting and does not itself request an impersonation service ticket or execute a command.