I have recently implemented Kerberos in my farm on a very basic level, the need for it was to resolve issues with MAC OS clients so that they would not have to log in each time they hit one of the three web applications we host on our intranet. I setup the SPN's for the web apps service account and also the SQL account that runs the instance of SQL on our cluster. I did not setup delegation on any of the accounts, thats another part of Kerberos i'm still trying to wrap my head around to better understand...so if anyone has any good reasons for delegation i'd like to hear them.
Aside from all of that, things are working good after i switched over the web apps from NTLM to Kerberos, i am able to see in the logs that the clients are using Kerberos to login...and they are not promopted to provide a password when they go from Intranet to mysites to search center...
However...when they access content that opens in a client side application like excel for example...they are required to login...so if a user is looking at an excel sheet in the office web app and chooses to open in excel, they are prompted to enter a login and password to access the content in the application. This only happens on my MAC clients...i assume that on the PC side of things they are using NTLM in some way.
When i setup the SPNs i did not create an SPN for the service application pool, could this be the reason? Or is it because i dont delegate the accounts i have created spn's for?
If anyone could shed some light on this i could use a better direction to head in as i try to figure this out.