Tips for finding Knowledge Articles

  • - Enter just a few key words related to your question or problem
  • - Add Key words to refine your search as necessary
  • - Do not use punctuation
  • - Search is not case sensitive
  • - Avoid non-descriptive filler words like "how", "the", "what", etc.
  • - If you do not find what you are looking for the first time,reduce the number of key words you enter and try searching again.
  • - Minimum supported Internet Explorer version is IE9
Home  >

KB-18089: How is Centrify impacted by the TGT delegation update pushed out by Microsoft?

Authentication Service ,  

6 August,19 at 08:36 PM


Microsoft made changes to the Kerberos TGT delegation across trusts by adding an
EnableTGTDelegation trust flag on July 9, 2019. How does this impact Centrify?

  1. If the customer is not using cross-forest trusts, then there is no impact.
  2. If the customer is using cross-forest trusts, there may be some impact, this depends on
    1. If the customer is using password login only, there should be no impact.
    2. If the customer is using single sign on (SSO), then after the first SSO hop, the user will not be able to do a second SSO hop, because there's no TGT forwarded on the first SSO hop. 


Note, the "first SSO hop", is not necessarily the "first hop", for example,

In the examples below, the user account is from the trusted cross-forest, hostA and hostB are from trusting forest.

putty  ---->  hostA  ----> hostB

(cross-forest user) putty password-login to hostA, then SSO to hostB, afterwards you cannot do another SSO from hostB

putty  --->  hostA  --X--> hostB

(cross-forest user) putty SSO-login to hostA, afterwards you cannot do another SSO from hostA. However, you can still do password login to hostB.

Microsoft has provided a powershell script in their KB that is referenced above. If this TGT Delegation flag needs to be reverted, consult with MS regarding any issues with the script. 


Centrify Corporation does not take any responsibility for the content or availability of this link and it was provided as a courtesy.  Customers should contact the vendor if there are any further questions