They are insisting that for Kerberos Delegation to work, the Tableau Server's service account needs Impersonate privilege (or SA) on the SQL Server. Unfortunately for them, I have configured Kerberos ...