diff --git a/python/samba/netcmd/delegation.py b/python/samba/netcmd/delegation.py
index 47dffb07d51..39397bbcc75 100644
--- a/python/samba/netcmd/delegation.py
+++ b/python/samba/netcmd/delegation.py
@@ -44,13 +44,24 @@ class cmd_delegation_show(Command):
         "versionopts": options.VersionOptions,
         }
 
+    takes_options = [
+        Option("-H", "--URL", help="LDB URL for database or target server", type=str,
+               metavar="URL", dest="H"),
+        ]
+
     takes_args = ["accountname"]
 
-    def run(self, accountname, credopts=None, sambaopts=None, versionopts=None):
+    def run(self, accountname, H=None, credopts=None, sambaopts=None, versionopts=None):
         lp = sambaopts.get_loadparm()
         creds = credopts.get_credentials(lp)
         paths = provision.provision_paths_from_lp(lp, lp.get("realm"))
-        sam = SamDB(paths.samdb, session_info=system_session(),
+
+        if H == None:
+            path = paths.samdb
+        else:
+            path = H
+
+        sam = SamDB(path, session_info=system_session(),
                     credentials=creds, lp=lp)
         # TODO once I understand how, use the domain info to naildown
         # to the correct domain
@@ -89,9 +100,14 @@ class cmd_delegation_for_any_service(Command):
         "versionopts": options.VersionOptions,
         }
 
+    takes_options = [
+        Option("-H", "--URL", help="LDB URL for database or target server", type=str,
+               metavar="URL", dest="H"),
+        ]
+
     takes_args = ["accountname", "onoff"]
 
-    def run(self, accountname, onoff, credopts=None, sambaopts=None,
+    def run(self, accountname, onoff, H=None, credopts=None, sambaopts=None,
             versionopts=None):
 
         on = False
@@ -105,7 +121,12 @@ class cmd_delegation_for_any_service(Command):
         lp = sambaopts.get_loadparm()
         creds = credopts.get_credentials(lp)
         paths = provision.provision_paths_from_lp(lp, lp.get("realm"))
-        sam = SamDB(paths.samdb, session_info=system_session(),
+        if H == None:
+            path = paths.samdb
+        else:
+            path = H
+
+        sam = SamDB(path, session_info=system_session(),
                     credentials=creds, lp=lp)
         # TODO once I understand how, use the domain info to naildown
         # to the correct domain
@@ -132,9 +153,15 @@ class cmd_delegation_for_any_protocol(Command):
         "versionopts": options.VersionOptions,
         }
 
+    takes_options = [
+        Option("-H", "--URL", help="LDB URL for database or target server", type=str,
+               metavar="URL", dest="H"),
+        ]
+
+
     takes_args = ["accountname", "onoff"]
 
-    def run(self, accountname, onoff, credopts=None, sambaopts=None,
+    def run(self, accountname, onoff, H=None, credopts=None, sambaopts=None,
             versionopts=None):
 
         on = False
@@ -146,9 +173,14 @@ class cmd_delegation_for_any_protocol(Command):
             raise CommandError("invalid argument: '%s' (choose from 'on', 'off')" % onoff)
 
         lp = sambaopts.get_loadparm()
-        creds = credopts.get_credentials(lp)
+        creds = credopts.get_credentials(lp, fallback_machine=True)
         paths = provision.provision_paths_from_lp(lp, lp.get("realm"))
-        sam = SamDB(paths.samdb, session_info=system_session(),
+        if H == None:
+            path = paths.samdb
+        else:
+            path = H
+
+        sam = SamDB(path, session_info=system_session(),
                     credentials=creds, lp=lp)
         # TODO once I understand how, use the domain info to naildown
         # to the correct domain
@@ -175,15 +207,25 @@ class cmd_delegation_add_service(Command):
         "versionopts": options.VersionOptions,
         }
 
+    takes_options = [
+        Option("-H", "--URL", help="LDB URL for database or target server", type=str,
+               metavar="URL", dest="H"),
+        ]
+
     takes_args = ["accountname", "principal"]
 
-    def run(self, accountname, principal, credopts=None, sambaopts=None,
+    def run(self, accountname, principal, H=None, credopts=None, sambaopts=None,
             versionopts=None):
 
         lp = sambaopts.get_loadparm()
         creds = credopts.get_credentials(lp)
         paths = provision.provision_paths_from_lp(lp, lp.get("realm"))
-        sam = SamDB(paths.samdb, session_info=system_session(),
+        if H == None:
+            path = paths.samdb
+        else:
+            path = H
+
+        sam = SamDB(path, session_info=system_session(),
                     credentials=creds, lp=lp)
         # TODO once I understand how, use the domain info to naildown
         # to the correct domain
@@ -219,15 +261,25 @@ class cmd_delegation_del_service(Command):
         "versionopts": options.VersionOptions,
         }
 
+    takes_options = [
+        Option("-H", "--URL", help="LDB URL for database or target server", type=str,
+               metavar="URL", dest="H"),
+        ]
+
     takes_args = ["accountname", "principal"]
 
-    def run(self, accountname, principal, credopts=None, sambaopts=None,
+    def run(self, accountname, principal, H=None, credopts=None, sambaopts=None,
             versionopts=None):
 
         lp = sambaopts.get_loadparm()
         creds = credopts.get_credentials(lp)
         paths = provision.provision_paths_from_lp(lp, lp.get("realm"))
-        sam = SamDB(paths.samdb, session_info=system_session(),
+        if H == None:
+            path = paths.samdb
+        else:
+            path = H
+
+        sam = SamDB(path, session_info=system_session(),
                     credentials=creds, lp=lp)
         # TODO once I understand how, use the domain info to naildown
         # to the correct domain
diff --git a/selftest/target/Samba4.pm b/selftest/target/Samba4.pm
index 6b34ba66158..d7aa9c5bc10 100644
--- a/selftest/target/Samba4.pm
+++ b/selftest/target/Samba4.pm
@@ -993,7 +993,8 @@ sub provision_rpc_proxy($$$)
 	$cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$dcvars->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
 	$cmd .= "KRB5_CONFIG=\"$dcvars->{KRB5_CONFIG}\" ";
 	$cmd .= "$samba_tool delegation for-any-protocol '$ret->{NETBIOSNAME}\$' on";
-	$cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD} $dcvars->{CONFIGURATION}";
+        $cmd .= " $dcvars->{CONFIGURATION}";
+        print $cmd;
 
 	unless (system($cmd) == 0) {
 		warn("Delegation failed\n$cmd");
@@ -1005,7 +1006,7 @@ sub provision_rpc_proxy($$$)
 	$cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$dcvars->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
 	$cmd .= "KRB5_CONFIG=\"$dcvars->{KRB5_CONFIG}\" ";
 	$cmd .= "$samba_tool delegation add-service '$ret->{NETBIOSNAME}\$' cifs/$dcvars->{SERVER}";
-	$cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD} $dcvars->{CONFIGURATION}";
+        $cmd .= " $dcvars->{CONFIGURATION}";
 
 	unless (system($cmd) == 0) {
 		warn("Delegation failed\n$cmd");