All constraints are related to Kerberos/Win32 API architecture/implementation.
- Servers [IIS/Apache] needs to be launched as host account or user
domain account, not as local account. [Local accounts have nothing
to do with Kerberos]
- GAS needs to be launched as Local System Account [Account
by default when installing (GAS) as service] or as Administrator [or
- of course - as a member of Administrators groups].
- HTTP Proxies are difficult to bypass with Kerberos