Multiple Login Attempts Required for Kerberos Constrained Delegation (KCD)

Attempt 1 from APM Logs

[:uri][/mysite/Home/Login?id=100

Fetched new TGT, total active TGTs:1

S4U ======> - fetched S4U2Self ticket for user: user

S4U ======> trying to fetch S4U2Proxy ticket for user: user

Requesting ticket can't get forwardable tickets (-1765328163)

Halted SSO retry for request

Session deleted due to admin initiated termination.

Attempt 2 from APM Logs

[:uri][/mysite/Home/Login?id=100

S4U ======> - we have cached S4U2Proxy ticket for user:

S4U ======> OK!

[:uri][/mysite/Home/...

S4U ======> - we have cached S4U2Proxy ticket for user:

S4U ======> OK!

[:uri][/mysite/jquery

S4U ======> - we have cached S4U2Proxy ticket for user:

S4U ======> OK!

S4U ======> - NO cached S4U2Proxy ticket for user:

Requesting ticket can't get forwardable tickets (-1765328163)

S4U ======> - we have cached S4U2Proxy ticket for user:

failure occurred when processing the work item

S4U ======> OK!

Session deleted due to admin initiated termination.

Attempt 3 from APM Logs

[:uri][/mysite/Home/Login?id=100]

S4U ======> - we have cached S4U2Proxy ticket for user:

S4U ======> OK!

[:uri][/mysite/Home/...

S4U ======> - we have cached S4U2Proxy ticket for user:

S4U ======> OK!

[:uri][/mysite/jquery

S4U ======> - we have cached S4U2Proxy ticket for user:

S4U ======> OK!