Blog Post

Microsoft Entra Blog
2 MIN READ

Kerberos Constrained Delegation, FE and BE Servers Must Be In Same Domain

Alex_Simons's avatar
Alex_Simons
Icon for Microsoft rankMicrosoft
Sep 07, 2018
First published on CloudBlogs on Oct, 24 2007 This has come up several times, and I suspect will continue to do so occasionally.   So I thought I’d post about this real qui...
Published Sep 07, 2018
Version 1.0
Alex_Simons's avatar
Icon for Microsoft rankMicrosoft
Joined May 01, 2017
View Profile
Microsoft Entra Blog
Stay informed on how to secure access for employees, customers, and non-human identities, from anywhere, to multicloud and on-premises resources, with comprehensive identity and network access solutions powered by AI.
RossUA's avatar
RossUA
Brass Contributor
Jun 03, 2021

Got the message on screenshot below in Wireshark, leading to the same error code when troubleshooting Kerberos Constraint Delegation. This post is the only good article that answers why this is not working. A bit sad, as several people here spent quite a few hours on this issue. But now we know. Thanks a lot for a simple explanation!

KRB5 220 KRB Error: KRB5KDC_ERR_POLICY NT Status: Unknown error code 0xc000040b