We are having issues with setting up SP2013 using a single content webapp with Kerberos authentication on it. This content webapp hosts all of our HNSC's, runs on port 443, has no host header and has a site on the root of it with Kerberos correctly configured.
Unfortunately, for Apps, the behaviour we are seeing is that the users in IE are prompted to login when accessing an App and can't successfully authenticate then login using any credentials, even the farm account. Somewhat gallingly, in Firefox it just works
perfectly with no prompting, but IE is our primary browser to get it working in. I was working under the assumption that this is a trusted sites/Intranet zoning issue, but on closer inspection, it looks more like Firefox just doesn't use Kerberos Auth and
therefore the prompting doesn't happen.
At the moment I'm considering two options:
1. Creating another web-app configured with a blank root site on port 443 with NTLM to host Apps as a quick fix, but then i'd need to get new IP addresses setup as otherwise port 80 would clash with the existing HNSC web app
2. Revert everything to use NTLM
It seems to say on Technet that Kerberos is supported for Apps as long as they can fall back to NTLM which I believe is already set for the main 443 content web-app in IIS. However, this does not appear to be happening here, as the fact that you can't then manually login when it prompts is different to what I'm reading. Has anyone seen anything similar and got past it?
Thanks,
Robin
