Currently, you can use gssproxy with [wiki:Apache] to to implement privilege separation for the Apache httpd server by removing access to the keytab while preserving Kerberos authentication functionality, but you cannot do this and use constrained delegation with either mod_auth_gssapi, or mod_auth_kerb.

There seems to be no way to configure gssproxy to retrieve and return the HTTP/ service ticket to the user@REALM during authentication, while at the same time enabling a second, per-process ccache for the delegated user@REALM credentials, exported as KRB5CCNAME which is available to Apache user processes.

It should also be noted that the solution must also not inhibit the ability for the Apache user (usually euid = 48) to access Kerberos-secured NFS filesystems using gssproxy via the methods details in [wiki:NFS].

This is useful for lots of things besides FreeIPA, though FreeIPA already has tickets in place to track this enhancement: https://fedorahosted.org/freeipa/ticket/4189 and https://fedorahosted.org/freeipa/ticket/4190.