The SMB configuration for retrieving user claims on behalf of the user should be consistent with the Kerberos capabilities ...