_ Hi Bernd
My draft post became over 2 pages, so I decided to cut some details, to get any replies at all.
I have tried AllowNtlm = false, but for some reason I get the error message "The remote server did not satisfy the mutual authentication requirement." when I run.
In IIS-Manager on the IIS-app I have only "Windows Authentication" and "Impersonation" Enabled, and Windows Authentication-provider is set to (only) Negotiate. I dont know how to force server to enable Kerberos. Anonymous auth is disabled both in the IIS-Subapp and the "Sharepoint 80"-site
Strangely enough I can set AllowNtlm to false when calling from test/console app.
The SP app (and everywhere else) is running http.