What we want to plan is a way to make gssproxy able to use s4u2self to obtain a ticket for a user to itself and the use s4u2proxy and use that ticket as evidence to obtain a ticket for nfs for example.

There is support for impersonation in gssapi already (see gss_acquire_cred_impersonate_name() and friends)

Each service would have a new configuration option "impersonate = yes|no" (defaults to no for now) to activate or deactivate the feature.