Authentication Defaulting back to NTLM not Kerberos

Question

We have 3 servers. One running SQL and 2 running Sharepoint. Both Sharepoint servers are acting as WFE's using NLB.

We have 2 Web Applications people.domain.local for our mysites and intranet.domain.local for all the rest of our content. Right now both are running on different application pools but using the same account. I have created an SPNs for the account. HTTP/people, HTTP/people.domain.local, HTTP/intranet, and HTTP/intranet.domain.local

I have added delegation to both WFE's and the application pool account but from the logs it appears that the users are logging in with NTLM still. I have also set the web applications to use Kerberos.

Is there something I am missing?

The part I'm missing.... My users including myself are users on a different domain. When I try to authenticate as a user of the same domain that the servers are part of I don't have any issues. Could this be something wrong with the trust?

Answer 1

Did you also configure the following IIS 7.x setting:

system.webServer/security/authentication/windowsAuthentication

useAppPoolCredentials=True

Answer 2

Two things to check into:

1. Make sure that you have a two-way trust between your domains
2. If you're accessing the servers using FQDN - make sure that that FQDN is in the Intranet sites in IE

Answer 3

Kerberos is definitely tricky to get right. I would recommend following the instructions in the following document exactly and in detail. Any small detail can break it and troubleshooting is painful.

http://go.microsoft.com/fwlink/p/?LinkId=196600

Regarding multiple domains, here is what it has to say:

The scenarios in this set of articles about Kerberos authentication require that the SharePoint Server service and external data sources reside in the same Windows domain, which is required for Kerberos constrained delegation. The Kerberos protocol supports two kinds of delegation, basic (unconstrained) and constrained. Basic Kerberos delegation can cross domain boundaries in a single forest, but cannot cross a forest boundary regardless of trust relationship. Kerberos constrained delegation cannot cross domain or forest boundaries in any scenario.

Answer 4

In IIS, navigate to your site(s) which has the problem. Click the "Authentication" button. Click on "Windows Authentication" and in the Actions pane, click "Providers". Move Kerberos above NTLM. Now Kerberos will always be tried first and then it will try with NTLM if Kerbeos fails.