I've make it work in the lab perfectly but at one client i've got the following error :
Constrained Delegation TGS fetch error: KDC can't fulfill requested option
here is a summary of the option from the log:
authtime: Tue Jan 19 13:40:09 2010,
startime: Tue Jan 19 13:40:09 2010, endtime: Tue Jan 19 23:40:08 2010, endtime sec:
1263962408, current sec: 1263926409, Flags reserved: 0, forwardable: 1, forwarded: 0,
proxiable: 0, proxy: 0, may_postdate: 0, postdated: 0, invalid: 0, renewable: 0,
initial: 0, pre_authent: 1, hw_authent: 0, transited_policy_checked: 0, ok_as_delegate:
0, anonymous: 0
so the ticket is fowardable. there is not much help on the web for this, as the only explanation i have found is this :
Be sure to check that you set the SPN correctly. Is your delegation account, OWA, and user account all in the same domain?
How is the sahrepoint resource configured on the backend?
Is the sharepoint server Hostname and the Resource url have the same name?