One of the bigger issues is the double-hop problem. It's both an important security boundary, and one of the biggest butt-pains about the protocol.

https://techcommunity.microsoft.com/blog/askds/understanding...

It works great within a single organization hierarchy, but becomes pretty painful for anything we'd consider "SaaS"