I don’t have Kerberos here, but to test it I use OS Authentication, which seems to work the same way as far as the database goes. I’ll describe my set up and hopefully it will help you understand what’s going on.
So my windows user in the database ends up being “OPS$PROD\JDORLON” (and I can log in as blank or EXTERNAL with this, without knowing the password). This is your user A.
Now, if I go into the Schema Browser, change object type to USERS, and click on user B in the list, then on the right, on the Proxies tab, I’ll see OPS$PROD\JDORLON. That was set up with this command:
ALTER USER B grant connect through “OPS$PROD\JDORLON”;
WIth Toad 12.8, if I try to connect EXTERNAL[B] (with a blank password), then what happens is exactly as you describe above - it prompts for password, and whatever I type in, I get an “invalid password” message.
But with Toad 12.9, logging in with EXTERNAL[B] (with blank password) works. I don’t get any prompt at all - it just connects. I don’t need to know B’s password because of the proxy grant.