The S4U2Proxy code has been tested against Active Directory and the MIT krb5 KDC.&nbsp; Typically S4U2Proxy operations are initiated via the GSSAPI, however; see&nbsp;<a href="https://web.mit.edu/kerberos/krb5-latest/doc/appdev/gssapi.html#constrained-delegation-s4u">https://web.mit.edu/kerberos/krb5-latest/doc/appdev/gssapi.html#constrained-delegation-s4u</a>&nbsp;and the test program t_s4u.c.<br />
<br />
The protocol error code corresponding to &quot;KDC can&#39;t fulfill requested option&quot; can have a variety of causes.&nbsp; One that immediately comes to mind is using a non-forwardable evidence ticket, but there are many others.&nbsp; It&#39;s possible that KDC logs could provide more information, but I am not very familiar with Active Directory&#39;s logging.<br />
<br />
As a note, MIT krb5 is an open source project and does not have an SLA with any other organization.&nbsp; We cannot guarantee any specific response time for bug reports or promise that they will be resolved.