Constrained Delegation Abuse (S4U2Proxy)

Classic Kerberos constrained delegation lets a service account obtain service tickets for users only to SPNs listed in msDS-AllowedToDelegateTo. When the delegating account has TRUSTED_TO_AUTH_FOR_DELEGATION (T2A4D, 0x01000000), S4U2Self can obtain a forwardable ticket representing a chosen user and S4U2Proxy can exchange it for a ticket to an allowed target service, without the target user's credentials. Without protocol transition, S4U2Proxy needs a forwardable service ticket for that user; the delegating account's credentials alone do not provide that path. Sensitive or otherwise nondelegable users and KDC policy constrain impersonation. Access obtained through the resulting ticket is limited by the target service and user's permissions.