I have a similar problem as described here: ARR 3 IIS 7.5 Windows Authentication not working
Unfortunately that solution does not work on our servers.
In our test environment we have an ARR server (Win 2012, IIS 8.0) and a web server (Win 2008R2). The web application on the webserver requires Windows authentication and it already works when the client is using NTLM as a response to the negotiate request. But when the client sends a Kerberos ticket the request is not forwarded to the webserver but instead answered by the ARR server with a HTTP 401 message.
I already tried a lot of recommendations without success. Either the authentication fails on the ARR or the webserver.
We had ARR 2.5 running but I also already tested with ARR 3.0 without success.
I also configured the SPN entries for the ARR and the web server (http://blogs.iis.net/brian-murphy-booth/archive/2007/03/09/the-biggest-mistake-serviceprincipalname-s.aspx). And tried to use the same user accounts for the app pool on the ARR and web server.
------- EDIT-------
- I tried the whole approach from the other working solution (ARR 3 IIS 7.5 Windows Authentication not working)
- Disable Kerberos on the ARR and Web (separatly) so that only NTLM is supported (fails on ARR)
- App pool with app pool identity and real account (same on ARR and web) with different SPN approaches
- Upgrade to ARR 3.0 and repeat all tries
The problem is always that the ARR server is reacting on the negotiate header even if the ARR is configured for anonymous.
BTW: KB 2732764 was installed long time ago