Tristank has a nice article 3 Simple Rules to Kerberos Authentication/Delegation SPNs on how Kerberos authentication via HTTP should be configured. It contains well explained steps using the SETSPN utility.