Part of the Kerberos v5 extension called S4U (Services for Users), this component allows a service to obtain a service ticket to itself on behalf of a client. This is commonly used with client certificates and is the Kerberos Protocol Transition extension of Kerberos.