Kerberos credential delegation: allowDelegation() and CLI --allow-delegate (winrs -allowdelegate)

winrs parity: -a[llow]d[elegate] — let the remote shell use the user's credentials to reach a further hop (a share on a third machine, a database, ...). Without delegation, anything the remote command does with the user's identity over the network fails with access denied (the classic double-hop problem).

Context

winrs implements this with CredSSP or Kerberos delegation. For this client:

• Kerberos (in scope): the JDK GSS-API supports delegation natively — GSSContext.requestCredDeleg(true) on the context KerberosAuthScheme already creates. The TGT must be forwardable (forwardable = true in krb5.conf, or a forwardable ticket in the ticket cache), and the target service must be trusted for delegation in AD (OK-AS-DELEGATE; for constrained delegation the KDC decides). All pure JDK, zero new dependencies.
• CredSSP (out of scope): NTLM-based delegation requires implementing CredSSP (TLS channel + SPNEGO inside TSRequest ASN.1 structures + credential submission). That is a whole new authentication protocol and a significant security surface; explicitly not part of this issue — file separately if ever needed.

Proposed API

try (WinRMClient client = WinRMClient.builder("server.example.net")
        .https()
        .authentication(AuthScheme.KERBEROS)
        .allowDelegation()                       // connection-scoped, Kerberos only
        .credentials("DOMAIN\user", password)
        .build()) {
    client.command("dir \\fileserver\share").execute();
}

• Builder-level (delegation is a property of the authentication, not of one command).
• build() rejects allowDelegation() when Kerberos is not among the requested schemes — silently ignoring it would give a false sense of security posture.
• When the KDC does not grant a forwardable/delegable ticket, GSS reports it — surface a clear message (this is the number-one support question with delegation).

CLI

winrm-java -h server -u 'DOMAIN\user' -pf pw.txt \
  --https --kerberos --allow-delegate \
  exec 'dir \fileserver\share'

Usage error when --allow-delegate is given without --kerberos.

Acceptance criteria

• requestCredDeleg(true) set on the GSS context iff delegation was requested; unit-testable at the KerberosAuthScheme level.
• Configuration rejections (NTLM-only + delegation) at build() / CLI parse time with actionable messages.
• Live validation against a real AD host with OK-AS-DELEGATE (see the internal test host) — the FakeWsmanServer speaks NTLM only, so delegation is covered by unit + live tests.
• Documented on the Authentication page (including the krb5.conf forwardable and AD trust prerequisites) and in the CLI manual.

🤖 Generated with Claude Code

Start by reading the existing KerberosAuthScheme and the client builder validation, then trace CLI option parsing and the Authentication and CLI manual pages. Verify delegation configuration and non-Kerberos rejection with unit tests, and complete the documented prerequisites plus live validation against the internal AD host.