Kerberos credential delegation: allowDelegation() and CLI --allow-delegate (winrs -allowdelegate)

Start by reading the existing KerberosAuthScheme and the client builder validation, then trace CLI option parsing and the Authentication and CLI manual pages. Verify delegation configuration and non-Kerberos rejection with unit tests, and complete the documented prerequisites plus live validation against the internal AD host.

winrs parity: -a[llow]d[elegate] — let the remote shell use the user's credentials to reach a further hop (a share on a third machine, a database, ...). Without delegation, anything the remote command does with the user's identity over the network fails with access denied (the classic double-hop problem).

Context

winrs implements this with CredSSP or Kerberos delegation. For this client:

• Kerberos (in scope): the JDK GSS-API supports delegation natively — GSSContext.requestCredDeleg(true) on the context KerberosAuthScheme already creates. The TGT must be forwardable (forwardable = true in krb5.conf, or a forwardable ticket in the ticket cache), and the target service must be trusted for delegation in AD (OK-AS-DELEGATE; for constrained delegation the KDC decides). All pure JDK, zero new dependencies.
• CredSSP (out of scope): NTLM-based delegation requires implementing CredSSP (TLS channel + SPNEGO inside TSRequest ASN.1 structures + credential submission). That is a whole new authentication protocol and a significant security surface; explicitly not part of this issue — file separately if ever needed.

Proposed API

try (WinRMClient client = WinRMClient.builder("server.example.net")
        .https()
        .authentication(AuthScheme.KERBEROS)
        .allowDelegation()                       // connection-scoped, Kerberos only
        .credentials("DOMAIN\user", password)
        .build()) {
    client.command("dir \\fileserver\share").execute();
}

• Builder-level (delegation is a property of the authentication, not of one command).
• build() rejects allowDelegation() when Kerberos is not among the requested schemes — silently ignoring it would give a false sense of security posture.
• When the KDC does not grant a forwardable/delegable ticket, GSS reports it — surface a clear message (this is the number-one support question with delegation).

CLI

winrm-java -h server -u 'DOMAIN\user' -pf pw.txt \
  --https --kerberos --allow-delegate \
  exec 'dir \fileserver\share'

Usage error when --allow-delegate is given without --kerberos.

Acceptance criteria

• requestCredDeleg(true) set on the GSS context iff delegation was requested; unit-testable at the KerberosAuthScheme level.
• Configuration rejections (NTLM-only + delegation) at build() / CLI parse time with actionable messages.
• Live validation against a real AD host with OK-AS-DELEGATE (see the internal test host) — the FakeWsmanServer speaks NTLM only, so delegation is covered by unit + live tests.
• Documented on the Authentication page (including the krb5.conf forwardable and AD trust prerequisites) and in the CLI manual.

🤖 Generated with Claude Code