Problems with Kerberos and delegation account

I has as username-source user the "session.ldap.last.attr.samAccountName" variable and the user realm source keept the default

I usually leave the field as is and do a variable assignment, but your way is also reasonable.

When I switch to advanced settings in this window I get the possibility to defined headers and names also - are they used for different site names or what?

This is just there to add optional headers to the request. I've never had to use this.