SharePoint 2010 hosted on IIS7, Kerberos enabled. Clients log on through Citrix on several terminal servers. Kerberos is working on several clients, so SPN's are defined correctly, but on some clients it does not work.
Problem
- Windows Authentication Enabled in Internet Explorer, providers Negotiate (first) and NTLM (second)
- Works on some clients. If "Integrated Windows Authentication" is enabled in IE, Kerberos ticket is sent. If setting is disabled, NTLM is used. Thus, as expected.
- On some "bad clients" I get "This page cannot be displayed" (DNS / connectivity error) after +- 20 seconds . If I look at Fiddler, I only see a 401 response from the web server. If I flip the providers in IIS, thus NTLM (first), Negotiate (second), it works! NTLM response is sent. If I then change it back to Negotiate (first), NTLM (second) it still works after IIS reset, until I log off and on from Citrix; then again "This page cannot be displayed".
- The site is added to local intranet. If it works at NTLM in "bad clients" I can see in the lower right corner "Local intranet". On the "good clients" Kerberos works too in Local Intranet zone. Also tried to add site in "bad clients" to Trusted sites, but that does not make a difference.
I have no clue why it still is not working. The problem looks like IE does not want to respond to HTTP/401 request with Negotiate, NTLM as auth. headers on some clients, but I have really no idea why not.
SOLVED IT. Alright, Kerberos and LDAP to the DC was not available on some DC's. So, changing settings in firewall solved the problem.
