We had a similar issue: If I am not mistaken, if you use XML Viewer Web Part and indicate a URL for the feed latter is not loaded on client side, i.e. not within the user's context. The server will try to fetch the feed that is if the target page is not public but needs authentication this hits you; Try to access your URL outside Single Sign On (SSO)/Integrateed Windows Authentication (IWA) e.g. using a different browser (Firefox/Chrome) not set up of IWA; if you cannot access it SP most probably also won't be able to.
Solution: Load and display the feed via custom JavaScript on the client (Web Part > Media and Content > Script Editor
) or have SP be allowed to access the feed (e.g. via its IP). Be aware though that if such a source needs authentication in the first place the content most probably will also be different for different users so first approach using the user's context might be preferable.