1 Introduction

  • Article

The Kerberos Network Authentication Service (V5) Service for User (S4U) Extension provides two extensions to the Kerberos Protocol. Collectively, these two extensions enable an application service to obtain a Kerberos service ticket on behalf of a user. The resulting service ticket can be used for:

  • The requesting service's own information.

  • Access control local to the service's machine, impersonating the user.

  • Requests to some other service, impersonating the user.

There are two different Service for User (S4U) extensions. The first is the Service for User to Self (S4U2self) extension, which allows a service to obtain a Kerberos service ticket to itself on behalf of a user. This enables the service to obtain the user's authorization data that is then used in authorization decisions in the local service.

The second S4U extension is the Service for User to Proxy (S4U2proxy) extension. This Kerberos extension enables a service to obtain a service ticket on behalf of the user to a second, back end service. This allows back-end services to use Kerberos user credentials as if the user had obtained the service ticket and sent it to the back end service directly. Local policy at the ticket-granting service (TGS) can be used to limit the scope of the S4U2proxy extension.

Sections 1.5, 1.8, 1.9, 2, and 3 of this specification are normative. All other sections and examples in this specification are informative.