For a single hop, ensure that the SPN is set correctly:
If the application runs with the system account, check it like this:
setspn -L computername
It should return either HTTP/computername or HTTP/dnsname
The prefix HOST is a "catch all" for HTTP and some others. So it should be OK as well.
If the application pool runs with custom identity (which is a member of a domain), check it with
setspn -L accountname
Then configure in IIS to use application pool credentials or else it won't be able to decrypt Kerberos ticket.
