Product:
Cognos BI 10.1.1
Windows 2008 R2 Server
IIS

Symptom:
User get a login dialog from the web server (IIS) when they surf to Cognos Connection.
You can not get past the login dialog, even if you enter correct username and password.
This happens after you activated Kerberos to access Cognos BI.

Login Dialog:
User name:
Password:

Cause:
There is duplicated SPN values to the web server (Cognos bi server) in Microsoft Active Directory.
The web server can not handle Kerberos if there are two different user accounts that have the same web server address.

Solution:
Login to a workstation in the network.
Run the command SETSPN -X to list all duplicated addresses.
Check to ensure that the servername is not listed twice for different user accounts.

Enter following command to remove one entry
setspn.exe -D HTTP/Servername.domain.com DOMAIN\useraccount

Replace servername.domain.com and DOMAIN\useraccount with yours values.

You can use the command SETSPN -L USERNAME to find the values for that account in the Active Directory.