title: Java SPNEGO Authentication & Kerberos Constrained Delegation (KCD) to backend service
body: <p>I have a Java web application which do SPNEGO authentication of clients in a Windows Active Directory environment.
  To authenticate the user we use code from the good old SPNEGO SourceForge project.</p>
  
  <pre><code>String encodedAuthToken = (String) credentials;
  LOG.debug("Encoded auth token: " + encodedAuthToken);
  byte[] authToken = B64Code.decode(encodedAuthToken);
  GSSManager manager = GSSManager.getInstance();
  
  try {
      Oid krb5Oid = new Oid("1.3.6.1.5.5.2");
      GSSName gssName = manager.createName(_targetName, null);
      GSSCredential serverCreds = manager.createCredential(gssName, GSSCredential.INDEFINITE_LIFETIME, krb5Oid, GSSCredential.INITIATE_AND_ACCEPT);
      GSSContext gContext = manager.createContext(serverCreds);
  
      if (gContext != null) { 
          while (!gContext.isEstablished()) {
              authToken = gContext.acceptSecContext(authToken, 0, authToken.length);
          }
          if (gContext.isEstablished()) {
              // Login succeeded!
              String clientName = gContext.getSrcName().toString();
          }
      }
  }
  </code></pre>
  
  <p>The authentication works good but we also have a requirement to delegate the user credentials to a back-end service (Exchange EWS), using constrained delegation.
  When configuring this in our AD it looks like a small difference, but it's not. See:
  <a href="http://i.stack.imgur.com/cDRsZ.png" rel="noreferrer">AD delegation settings</a></p>
  
  <p>The difference is described here: msdn.microsoft.com/en-us/library/cc246080.aspx?f=255&amp;MSPPError=-2147217396
  With unconstrained delegation we could simply use the available delegated credentials when we call the back-end service and it would all be good:</p>
  
  <pre><code>GSSCredential delegatedCreds = gContext.getDelegCred()
  SpnegoHttpURLConnection conn = new SpnegoHttpURLConnection(clientCreds);
  </code></pre>
  
  <p>With constrained delegation we have no access to the users TGT and it seems we need to use the MS-SFU (S4U2proxy) Kerberos extension which Java 8 is suppose to support.
  The only example I could find is this one: <a href="https://github.com/ymartin59/java-kerberos-sfudemo" rel="noreferrer">https://github.com/ymartin59/java-kerberos-sfudemo</a> (thanks Yves Martin for that!)</p>
  
  <p>Now to my problem... After my authentication I basically end up with the username of the authenticated user (see "clientName" in code above).</p>
  
  <p>Do we really need to use the S4U2self mechanism to impersonate the user here? 
  The client just sent us it's Kerberos Service Ticket (wrapped in the SPNEGO token I can't decode).
  Ideally we should be able to use that service ticket and my own service's TGT to authenticate the user (using the S4U2proxy mechanism)?
  But I do not understand how. </p>
  
  <p>So now I'm wondering if it's possible to tie together our SPNEGO authentication with S4U2proxy delegation?</p>
  
  <p>Many thanks for any input on this.</p>