mod_proxy_kcd trusts Apache's authenticated user value. The deployment is secure only when that value comes from a correctly configured and current mod_auth_openidc, using a dedicated Authentik provider, strict redirect URI, expected issuer, expected client ID/audience, and a signed UPN claim. Do not set REMOTE_USER from an inbound HTTP header or an unauthenticated rewrite rule.

Use mod_auth_openidc 2.4.20.3 or a later security-fixed release. Do not pass OIDC tokens, claims, the generated Negotiate token, or an Authorization header to application logs.

• Create a dedicated non-administrative AD service account.
• Give it only protocol-transition delegation to the exact Exchange HTTP SPN.
• Use AES keys; do not enable DES or RC4 for this project.
• Store the keytab outside the web root, owned by root and the Apache group, normally mode 0640.
• Do not put the keytab in an image, source repository, backup set without encryption, or configuration-management log.
• Rotate the account key and keytab through an overlap/change procedure and reload Apache.

Compromise of the keytab allows the holder to impersonate permitted users to the delegated target services. This is the central secret of the system.

Never configure unconstrained delegation. In classic constrained delegation, msDS-AllowedToDelegateTo must contain only the exact HTTP/mail... SPN(s). TrustedToAuthForDelegation is required for protocol transition but does not replace the target allow-list.

Set KcdAllowedUserRealm even if the current forest has one UPN suffix. Apply an Authentik policy to restrict the application to intended users, and apply a stricter group policy to /ecp if administrative ECP access is published.

• Keep SSLProxyVerify require and peer-name checking enabled.
• Use SSL bridging, not TLS offload to plaintext Exchange.
• Apache and Exchange must use the exact same leaf certificate for the published namespace when Exchange Extended Protection requires CBT.
• Keep Exchange Extended Protection enabled. Do not solve CBT errors by disabling it.
• Make certificate deployment atomic enough to avoid a mixed-certificate window.

Allow the Apache host to reach only:

• Authentik over HTTPS;
• AD DNS and KDCs (TCP/UDP 53 as required, TCP/UDP 88, and TCP/UDP 464 only if operationally required);
• the Exchange origin over TCP 443;
• time synchronization services.

The Exchange origin should accept HTTPS from the proxy and trusted internal networks, not directly from the internet. Accurate time and DNS are mandatory for Kerberos.

Alert on repeated S4U2Self failed, S4U2Proxy ... failed, upstream 401, certificate mismatch, and tokens exceeding KcdMaxTokenSize. A sudden rise usually means delegation/SPN changes, clock drift, DC reachability problems, certificate rollout mismatch, or an AD group/PAC size increase.

Version 0.1 intentionally creates a fresh user proxy credential for each HTTP request. The service TGT remains in the configured memory ccache, but high-volume environments should load-test DC/KDC demand before broad rollout. Start with a small pilot group and at least two reachable DCs. A future credential-cache layer must preserve per-user isolation, expiry, and thread safety; it should not be added casually.