About Active Directory automatic configuration
Active Directory automatic configuration assists with setting up authentication using delegation or replication.
Using replication you can assign a restricted set of privileges to a user, known as a replication user. You can configure the replication user on a per-forest basis so that the user assigned to it can retrieve machine credentials from any domain controller in any trusted domain within the forest. A forest can comprise multiple domains with trusts between them.
Ensure the replication user has sufficient privileges on the domain controller.
A replication user is required in each of the domains where traffic will be accelerated.
The final step in configuring replication users is to add users to either the allowed password replication group or the denied password replication group.
Delegation mode is deprecated, and we recommend that you do not use it. Instead, use WinSec Controller or replication users. Because delegation is deprecated, instructions for using it are not included here. Consult previous versions of this document for that information.
Using delegation requires additional configuration (beyond joining the server-side SteelHead to a domain) because delegation mode uses the Active Directory constrained delegation feature. You must configure both the server-side SteelHead and the Windows domain that it joins.
Constrained delegation is an Active Directory feature that enables configured services to obtain security related information for a user. Configuring constrained delegation requires the creation of a special delegate user account in the Windows domain. The account allows the delegate user the privilege of obtaining security information for use with specific applications (like CIFS and MAPI), and then configuring the delegate user credentials on the server-side appliance.