IPA has 3 Kerberos ticket flags for services:

From code:
ticket_flags_params = (
    Bool('ipakrbrequirespreauth?',
        cli_name='requires_pre_auth',
        label=_('Requires pre-authentication'),
        doc=_('Pre-authentication is required for the service'),
        flags=['virtual_attribute', 'no_search'],
    ),
    Bool('ipakrbokasdelegate?',
        cli_name='ok_as_delegate',
        label=_('Trusted for delegation'),
        doc=_('Client credentials may be delegated to the service'),
        flags=['virtual_attribute', 'no_search'],
    ),
    Bool('ipakrboktoauthasdelegate?',
        cli_name='ok_to_auth_as_delegate',
        label=_('Trusted to authenticate as user'),
        doc=_('The service is allowed to authenticate on behalf of a client'),
        flags=['virtual_attribute', 'no_search'],
    ),
)

_ticket_flags_map = {
    'ipakrbrequirespreauth': 0x00000080,
    'ipakrbokasdelegate': 0x00100000,
    'ipakrboktoauthasdelegate': 0x00200000,
}


In CLI help it looks like:

  --requires-pre-auth=BOOL
                        Pre-authentication is required for the service
  --ok-as-delegate=BOOL
                        Client credentials may be delegated to the service
  --ok-to-auth-as-delegate=BOOL
                        The service is allowed to authenticate on behalf of a
                        client

Documenation doesn't list ok-to-auth-as-delegate. The Web UI screenshot shows only 1 krb flag. So the screenshot should be updated.

SME for description or purpose of the third flag is Alexander.

Same flags can be set also for host objects.