Constrained Delegation with S4U2proxy

This figure contains three icons that represent Duke, Gateway, and Backend Server. Enterprise Network consists of Gateway and Backend Server. An arrow labeled "Context established but credentials not delegated" points from Duke to Gateway. An arrow labeled "Pretends to be duke" points from Gateway to Backend Server.