Sorry. You are absolutely right. Long day... I disable Kerberos ticket forwarding here, for this exact same reason. But then you don't have ticket forwarding!

Sorry. You are absolutely right. Long day... I disable Kerberos ticket forwarding here, for this exact same reason. But then you don't have ticket forwarding! I don't know what I was thinking.