I am setting up Kerberos and I have some strange issues. I am testing it with two users one who has a valid SPN and are trusted for delegation (user1) and one who does not have a valid SPN and is not trusted for delegation (user2). The tests are performed on the server and on a client. The users are set at application pool level. This is how it is working at the moment
From the server:
Using IP to access Application running under user1: Negotiate and chooses NTLM
Using domain name to access Application running under user1: Kerberos
Using IP to access Application running under user2: Negotiate and chooses NTLM
Using domain name to access Application running under user2: Negotiate and chooses NTLM
From the client:
Using IP to access Application running under user1: Kerberos
Using domain name to access Application running under user1: Kerberos
Using IP to access Application running under user2:Logon Process:Kerberos, Unknown user name or bad password
Using domain name to access Application running under user2: Logon Process:Kerberos, Unknown user name or bad password
Is it possible to solve this so that I only need to use setspn for the users that actually need delegation but get kerberos/NTLM to work with the other users that don't need delegation? So that I can use setspn for the user accounts that needs delegation and just use the other accounts without having to configure them? It seems like the Kerberos packages don't find there way to the server for users to since it is working with NTLM when I am testing on the server but not when I am testing from the client.