[Autogenerated] What is the Kerberos Second hot problem.
Well, number one, remember that an active directory.
We're dealing with Kerberos authentication and the second
hot problem occurs when you have a user,
let's say,
an administrator on their workstation and they want to
pass through an intermediary server.
In other words,
the user makes a remoting session with server one with their own credentials,
with their own domain credentials, let's say.
And then from that remoting session,
they attempt to say a nested remoting session to server two or they want to
send a command to server two using their original credentials.
Well, that's the second hot problem.
For security reasons,
Kerberos is not going to delegate or impersonate that user on that second hop.
So that second command that is that command to server
two is going to fail by default.
Now there's a couple workarounds to that.
The one that the exam objectives for aZ 800 call out his credit SSP,
there's some other better options in my humble opinion.
Check the exercise files because I give you some references there,
but the exam specifically mentions the credential security
support provider or cred SSP protocol.
Now this protocol enables unconstrained credential delegation
from the client to the target server for remote.
Now the issue here with credit SSP is that word unconstrained,
which means that the credential passing isn't
restricted to a particular service.
As you'll see in the demo we enable cred SSP on the client and server machines.
The client would be the machine that's passing the credentials and
the server would be the ultimate target of those.
Now, constrained Kerberos delegation is where you can be very intentional,
not only where your clients and servers are,
that's what credit SSP can identify.
But with constrained Kerberos delegation,
you can track it to particular services SSP is just an allow list that
globally allows those credentials to be passed to any service, which obviously is a security sensitive operation.