2

Referred to the official microsoft documentation on KCD where they are using the terms KCD & Resource Based Constrained Delegation (RBCD) almost interchangeably which got me confused. They have not mentioned anything related to the deprecation but "RBCD is the successor of KCD". Want to know if KCD is still in use or completely replaced by the newer RBCD method?

2
  • 2
    The article says that an extension was added to KCD. I'm not sure how you can conclude that KCD was replaced. New functionality was added. The article does not say that RBCD is the successor. Where did you read that? I googled the phrase and could not find it. So, I'm thinking that this is just a language/reading issue.
    – schroeder
    Commented Jul 11 at 8:11
  • 1
    My rough understanding (as an AD outsider) is that the protocol mechanism remains the same but the configuration (i.e. the direction in which the ACLs go) has been flipped around?
    – grawity
    Commented Jul 18 at 10:14

2 Answers 2

1

In Unconstrained Delegation (not mentioned in your article but required knowledge for context) the server that has UC enabled will obtain a TGT from the Domain Controller (I will call it Domain Controller as opposed to a KDC because KDC is too close to KCD below) and be able to use it to impersonate any user to request a TGS for any service on any other machine. This is obviously a problem if an attacker compromises the server.

So Microsoft came up with KCD (Kerberos Constrained Delegation although everyone just calls it Constrained Delegation) is a method by which the server only allows access to specific services. This is the important part - THE SERVER DECIDES WHAT SERVICES IT CAN DELEGATE TO (the msDS-AllowedToDelegateTo attribute). This way an attacker can't compromise the server and just request anything they want. There is a vulnerability whereby alternate services can be requested and aren't checked.

Microsoft then decided to up the security again with RBCD (Resource Based Constrained Delegation). This time instead of the server deciding what services it can delegate to, THE SERVICE HOLDS A LIST OF WHAT SERVICES CAN DELEGATE TO IT (the msDS-AllowedToActOnBehalfOfOtherIdentity attribute).

In Constrained Delegation anyone with SeEnableDelegation privilege can configure delegation but with Resource Based Constrained Delegation only the service owner can configure delegation (or anyone with the correct ACE).

All types of delegation still exist and operate depending on use case and how an environment is set up. While RBCD is more secure than Unconstrained Delegation there may be cases where Unconstrained Delegation is still used for some services for example to ensure reverse compatibility (this is more a question suited to system administrators as to why they choose one over the other). You will also see unconstrained delegation on Domain Controllers.

Edit: I believe Microsoft no longer allows unconstrained delegation if Credential Guard is enabled.

1
1

To answer the question more directly: No, the original Constrained Delegation is not deprecated. Deprecations are announced early on Microsoft Docs, and you can see things like NTLM up there.

I also recommend reading this article by someone on the team to gain more understanding on AD delegation.

New contributor
DL444 is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .