IIS to SQL Server kerberos auth issues

Question

We have a 3rd party product that allows some of our users to manipulate data in a database (on what we\'ll call SvrSQL) via a website on a separate server (SvrWeb).

<

Answer 1

There are several possible reasons for kerberos failures which includes lack of SPN and duplicate SPN as well.

If SQL is running under custom account you would need to add SPN for SQL as well.
Also keep in mind, you should be adding SPN for the FQDN which is the host (A) entry in DNS and not a CNAME.

Check the value of NTAuthenticationProviders
http://support.microsoft.com/kb/215383

Try DelegConfig which would show what is missing if its SPN or something else.
http://www.iis.net/community/default.aspx?tabid=34&g=6&i=1887