Some news from our side:
after latest information provided by Alexander/Rob (thank you very much) we've tested
again and we can confirm within idm (linux) all is fine (if using forward delegation it
works).
From windows to linux it stopped working and so we've asked our windows admin
colleagues and they've rollbacked the latest updates for the past couple days in our
LAB.
As it seems (at least) KB4507448 [1] update breaks the out-of-box support for AD-User
accessing remote NFS-share using kerberized (forwarded) access.
From our point of view, the workaround for now will be (in accordance to [2]) to configure
an "insecure" domain setting on AD side. If possible this could be eliminated to
not have to document an not secure setting in the future...
Once more, thank you both Alexander/Rob in participating and helping to solve the core
issue.
Rolf
[1]
https://support.microsoft.com/en-us/help/4507448/windows-8-1-update-kb450...
[2]
https://support.microsoft.com/en-us/help/4490425/updates-to-tgt-delegatio...