Kerberos terms, as this site uses them.

SPN

Service Principal Name. The identifier a client asks the KDC for when it wants a ticket to a service. Shape: class/host:port. Stored in the servicePrincipalName attribute of the account the service runs as.

Service class

The first segment of an SPN: MSSQLSvc, HTTP, HOST, TERMSRV, WSMAN, CIFS, oracle, SAP. Some are versioned (MSOLAPSvc.3).

KDC

Key Distribution Center. In Active Directory, every domain controller. Issues tickets encrypted with the key of the account that holds the SPN.

Service ticket

What the client presents to the service. If the SPN is on the wrong account, the ticket is encrypted with the wrong key and the service cannot read it.

NTLM fallback

What happens when Kerberos cannot be negotiated: the client silently uses NTLM. Works where NTLM is allowed, fails on double hops and wherever NTLM is blocked.

Cannot generate SSPI context

The client-side error when the SPN could not be resolved to a ticket. The cause is almost never where the message points.

KRB_ERR_S_PRINCIPAL_UNKNOWN

KDC error when the requested SPN is on no account, or on more than one.

KDC_ERR_ETYPE_NOSUPP

KDC error when the account and the KDC share no acceptable encryption type: typically RC4-only against an AES-only policy.

KRB_AP_ERR_MODIFIED

Service could not decrypt the ticket. Common cause: the SPN is on a different account than the service runs as, or a keytab is stale.

Duplicate SPN

The same SPN on two accounts. The KDC cannot choose a key and fails.

Keytab

A file holding a principal's keys, used by services that cannot ask AD for them directly: Linux, Java, Oracle, SAP, appliances. Must match the account's current key version.

KVNO

Key version number. Incremented on password reset. A keytab at the old KVNO is stale.

Enc-type

Encryption type the account supports, from msDS-SupportedEncryptionTypes: DES, RC4, AES128, AES256. RC4-only accounts are the common breaker since KB5021131.

Unconstrained delegation

TrustedForDelegation = true. The service can impersonate any user to any service. High risk.

Constrained delegation (KCD)

msDS-AllowedToDelegateTo lists the SPNs the account may delegate to. Broken when a listed SPN is registered nowhere.

Resource-based constrained delegation (RBCD)

msDS-AllowedToActOnBehalfOfOtherIdentity on the resource lists who may delegate to it. Inverts KCD.

Double hop

Client to middle tier to back end, as the user. Requires Kerberos on the first hop and delegation on the second.

Negative control

A proof design in which the baseline must show the failure (NTLM) before the change can be credited with the fix (Kerberos).

Oracle (proof)

An independent reading of the negotiated mechanism: SqlAuthScheme from sys.dm_exec_connections, or HttpSpnego from a web client. Not the database vendor.

Coverage disposition

One of three: audited-clean, audited-findings, unreached.

Hand-off

Output for someone else to act on: a setspn bundle for an AD administrator, or an operator runbook for a far-side host.