Recently, at work I ran across the damndest issue regarding Kerberos authentication and sporadic 401 authorization issues. Here is a bit of the background.
There is an enterprise WinForm application deployed to the desktop. That application relies heavily on consumption of web services. Recently we had a requirement to start using Integrated Authentication on one of those services because we needed to be able to pull the user's identity and log it as part of the audit trail. When we turned off Anonymous access to the service, we started getting reports that occasionally users would get 401 errors. The only commonality was that there were multiple users running as a test account (RunAs...). The other thing that was noticed was that the problem would occur after about 10 minutes.
So to debug we set up Packetyzer to record the traffic between the client and the server. We noticed that while things were working the server would issue a 401 auth challenge and the web service proxy would reply in kind. Then after about 10 minutes the server would issue an auth challenge and the client would respond by just sending the post to the server. It would not include the auth token in the WWW-Authenticate header. From that point forward the server would stop sending auth headers. This would result in additional 401's being sent until the 3 try limit would be hit and the request would fail.
In doing some research, it appeared to be that somehow the auth ticket would expire and no longer get a new one. The hard part was trying to figure out the sporadic-ness of it. Well in my research I came across an article that suggested to turn off Kerberos on the server. IIS6 by default has 'Negotiate,NTLM' as the default NTAuthenticationProviders for the server. To turn off Kerberos you need to set the value to be 'NTLM' only. This can be done one of two ways. Those links are posted below.
I hope this helps other where it sucked the life out of me.
http://www.microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/7258232a-5e16-4a83-b76e-11e07c3f2615.mspx?mfr=true
http://support.microsoft.com/?id=215383