IIS ARR pass-through Windows authentication does not work

Solution 1:

I finally found a solution for us:

Since we don't have the requirement for "multi-hop" authentication (=kerberos) I was able to force NTLM. On the web server under auhtentication (site) I changed the providers for Windows Authentication and removed everything but NTLM. So NTLM is the only available way for authentication.

On the ARR I changed everything back to the original settings and enabled anonymous access only. Then ARR is able to pass-through the authentication to the web server.

In my opinion Microsoft has a bug in the Kerberos handling and it does not depend on whether the authentication is proceeded in ther Kernel or by the ARR.