My Webserver has different names (DNS names) and my Integrated Authentication Fails – what to do

Explanation:

Kerberos Authentication Requires SPNs for Multiple Worker Processes

You
can isolate Web sites that are in different worker processes and
running under different identities; however, unexpected IIS behavior
might occur if you use Integrated Windows authentication. Integrated
Windows authentication attempts to use Kerberos authentication, which
might not work, depending upon the identity of the worker process. To
use Kerberos authentication, a service must register its Service
Principal Name (SPN) in the account in the Microsoft Active Directory®
directory service under which the service is running. By default,
Active Directory registers the NetBIOS name or computer name and allows
the Network Service or LocalSystem user accounts to use Kerberos.
However, for Kerberos to work with the following configurations, you
must first register an SPN:

You
can use the Setspn.exe command-line tool to register an SPN on the
account under which the worker process is running. You must be a domain
administrator to set an SPN. The Setspn.exe tool is included in
Resource Kit Tools for Windows Server 2003, available on the Windows Server 2003 Deployment Kit companion CD, or on the Web at http://www.microsoft.com/reskit.

obtained from: http://www.microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/77cf4a99-9e0e-42be-8c2e-eaa4cb24c200.mspx?mfr=true

RESOLUTION

loadTOCNode(1, 'resolution');

WORKAROUND

loadTOCNode(1, 'workaround');To
work around this behavior if you have multiple application pools that
run under different domain user accounts, you must force IIS to use
NTLM as your authentication mechanism if you want to use Integrated
Windows authentication only. To do this, follow these steps on the
server that is running IIS:

NTAuthenticationProviders       : (STRING) "NTLM"

obtained from:
http://support.microsoft.com/default.aspx?scid=kb;en-us;871179