This message was deleted.

Couldn't you create a sub site on the IIS where you test KCD first? Because in my experience your SPN or delegation isn't done correctly, the NetScaler is normally easy enough

Yeah the subsite is probably the best way for me to test. Occam's razor strikes again. Thanks Mads.

I once thought I figured Kerberos/KCD, but it's still a bit puzzling. Need to dig in to it once again, now that the Secure Access Client brought in the support for it...

The biggest issues are almost around faulty SPN or incorrect delegations, because Microsoft isn’t doing it for the admins now, they have to create it themselves. Use setspn -s when adding (so it verifies no duplicate) and remember it’s http/service and not https/ (and try not to use host/service) and witeshark is great to troubleshoot

yeah, I think there was some level of confusion with that spn registration, I actually did once a SAML IdP with Kerberos SSO using AAA to replace ADFS at one customer, it worked for the most part, but there was some faults to it and we ended up migrating that role to Entra ID, it's sooooo much easier to configure 😄