3.1.3 Initialization

Before sending a KRB_TGS_REQ message with a Service for User (S4U) extension, the service MUST have already authenticated to the Key Distribution Center (KDC) and received a ticket-granting ticket (TGT).