Hi Sir,
I don't still exactly KCD(Kerberos Constrained Delegation across domains) feature what it is.
But, when I read the Technet web page, it seemed best matched to the situation that I want to solve.
http://technet.microsoft.com/en-us/library/hh831477.aspx#BKMK_kerb_const_del_domains
I just needed the feature that database server can Active directory authentication even though Active directory server located physically separated on their network same like following picture.
In this situation, is it right to use the KCD across domain feature?
How can database server AD authentication?
The back-end network haven't router and Application server only can connect with database.
Hope to find the best solution database can AD authenticataion in this situation.