We need to be sure that GSS-Proxy always allows s4u2self, and that the impersonate permissions work correctly (no delegated credentials if impersonate is not true).
Fixed in 6fb14b1
Metadata Update from @rharwood: - Issue assigned to simo - Issue set to the milestone: 2016 January