We are hoping to the implement Kerberos on our Active Directory (2003, Functional Level 2) so that our SQL Server 2005 databases can communicate with one another when a client is using Active Directory Trusted Connectivity.
The reason this wasn't implemented back in the day (circa 2001?) is that we were highly concerned about the holes using Kerberos left open. We haven't truly revisited this issue until now. After reading a couple articles today, namely How to Implement Kerberos Constrained Delegation with SQL Server 2008 and Understanding When Kerberos Delegation Is Needed for SQL Server we see that it's possible to limit this to SQL Server.
- What are some possible pitfalls that we will run into?
- What might break?
- Is there a reason not to do this?
EDIT: And dang it...I can't add a Kerberos tag!