Kerberos authentication prompting for credentials in Sharepoint 2013

Question

Hello all,
I think I’m a bit confused on what I should expect out of Kerberos and sharepoint.
Following the steps located in
http://blog.blksthl.com/2012/09/26/the-first-kerberos-guide-for-sharepoint-2013-technicians/ , I’ve setup Kerberos in my Sharepoint 2013 environment. My hope was that configuring kerberos authentication would solve the issue of users being prompted for
credentials when they access sharepoint. I know that one way to address this problem is to tweak the IE settings by adding the site to the local intranet or trusted zones, but am I wrong in thinking that Kerberos should also authenticate the user on to the
site? Here’s my situation:
Previously, I had our sharepoint URL in the trusted zone and had IE set to pass my credentials through, and that worked. After configuring Kerberos, I can see the tickets on my system using klist and the security log on our web front-end shows that I authenticated
using Kerberos.
However, if I then remove the sharepoint URL from the trusted zone in IE, I still get prompted for credentials. If I cancel the credential prompt, I get a 401 error and the security log on the server shows a NTLM login attempt.
As soon as I put the URL back in the trusted zone, I can access the site and the server log shows a Kerberos authentication.
I’m I wrong in thinking that if Kerberos was working properly then I shouldn't need to have the URL in the trusted zone?
Thanks
Bill

Answer 1

Thanks for the quick reply, Alex. At least it’s good to know it appears to be working as designed.
Thanks again,
Bill