We have a .NET MVC 3 application deployed in IIS 7 on our Windows 2008 server (let's call it PROD). The application has Anonymous and Windows Authentication enabled - all others are disabled. The authentication providers specified in applicationHost.config are Negotiate and NTLM, in this order.
Lately we've started experiencing problems with authentication in this app. Users (who are in a different domain than the server) connecting with IE with "Enable Integrated Windows Authentication" option checked get "Not Authorized. HTTP Error 401. The requested resource requires user authentication." message even though they're supplying valid credentials. When accessing application from Firefox the problem does not occur. Also when using IE with "Enable Integrated Windows Authentication" unchecked everything works fine.
From what I've read about similar issues over the Internet, I've figured out that we have some problems with Kerberos not being configured properly. It turns out that NTLM authentication works just fine. I've checked the SPNs and they seem to be configured correctly (there is the default configuration as our app is being accessed by the server's netBios name).
The funny thing is we have another server (let's call it DEV) that hosts exactly the same app and is in exactly the same domain and has the same authentication and authentication providers configuration and application pools are run under the same accounts and authentication there works just fine. The only difference is that PROD has had .NET 4 installed recently but I don't think this might be an issue. Also PROD hosts this application in IIS in a following virtual directory: Sites/XYZ/XYZ so that you access the site by url
http://server:8666/XYZ. Application on DEV is hosted in IIS directly in Sites/XYZ and is accessed by url
Could you please advise me what else can I check? I tried turning on Kerberos logging but found no logs in the event viewer after trying to access the application. I have no other ideas where to look and what to check.