We develop a web application that is installed on-site on customers' servers. In the past months, we've had a curious problem occurring every now and then. We also know how to workaround it, but I'm really curious about the cause of the problem:
- We install our application on the customer's IIS (7 and 7.5). The application is configured to use (only) Windows authentication.
- Since the server is in the clients' "local intranet" zone (same domain), the clients don't need to enter their credentials when accessing the web application with IE.
- The application runs fine for months.
- Suddenly, without any apparent reason, the clients get asked for their credentials when trying to access the web application. Access is denied, even if the correct credentials are entered (i.e., the "enter your credentials" window keeps popping up).
- Automatic authentication still works fine when accessing the web site with IE on the server itself.
- The client configuration (IE zones, etc.) has not changed. The problem can be reproduced on all client PCs.
- In IIS manager, configuring Windows Authentication for this web application to prefer "NTLM" over "Negotiate" fixes the problem.
Still, I'm curious why this happens. The event logs did not show any useful information. I did some research, and, apparently, there are various reasons why Kerberos does not work, but none that explains why it suddenly stops working. Is there, for example, some Microsoft Update patch that is known to cause problems? What could I do to debug the issue? Needless to say, when I mention the word "Kerberos", the customer's sysadmin usually looks at me with a blank expression; unfortunately, I'm not terribly familiar with it myself (we are mainly developers, not sysadmins).