ASP.NET + NetworkCredentials, The logon attempt failed

Question

I've got an ASP.NET app that requires Windows Integrated Security. For some reason, I don't what to discuss that here, I need to create a WebRequest at runtime, call some other page in the app and process the result.

The application runs on a server for which we use a DNS alias, something like theapp.domain.com.

So I create a NetworkCredential with a predefined domain user and password and I attach it to the request.

This is what I get:

    [Win32Exception (0x80004005): The logon attempt failed]
  System.Net.NTAuthentication.GetOutgoingBlob(Byte[] incomingBlob, Boolean throwOnError, SecurityStatus& statusCode) +1404402
  System.Net.NTAuthentication.GetOutgoingBlob(String incomingBlob) +78
  System.Net.NegotiateClient.DoAuthenticate(String challenge, WebRequest webRequest, ICredentials credentials, Boolean preAuthenticate) +560
  System.Net.NegotiateClient.Authenticate(String challenge, WebRequest webRequest, ICredentials credentials) +14
  System.Net.AuthenticationManager.Authenticate(String challenge, WebRequest request, ICredentials credentials) +247
  System.Net.AuthenticationState.AttemptAuthenticate(HttpWebRequest httpWebRequest, ICredentials authInfo) +243
  System.Net.HttpWebRequest.CheckResubmitForAuth() +232
  System.Net.HttpWebRequest.CheckResubmit(Exception& e) +5299747

[WebException: The remote server returned an error: (401) Unauthorized.]
  System.Net.HttpWebRequest.GetResponse() +5313085
  Entropy.Envoy.Web.Corporate.ExportFilter.GetTargetReportContent(Uri targetUrl, HttpCookieCollection cookies) +521
  Entropy.Envoy.Web.Corporate.ExportFilter.Page_Load(Object sender, EventArgs e) +139
  System.Web.Util.CalliHelper.EventArgFunctionCaller(IntPtr fp, Object o, Object t, EventArgs e) +14
  System.Web.Util.CalliEventHandlerDelegateProxy.Callback(Object sender, EventArgs e) +35
  System.EventHandler.Invoke(Object sender, EventArgs e) +0
  System.Web.UI.Control.OnLoad(EventArgs e) +99
  System.Web.UI.Control.LoadRecursive() +50
  System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +627

The same code works on other servers with similar setup though. What is going on?

Answer 1

Found the answer to this one. Turned out to be as simple as adding an SPN to Active Directory like so:

setspn -a HTTP//WebServer.domain.com customDomainAccount
setspn -a HTTP//servername customDomainAccount