Hi,
You don't need to create a keytab with ktpass if you have done it with transaction "spnego" and sapgenpse.
The service user "krbtgt" is the one used for windows login. This is OK. Did you check if the domain part is the one you use to create the keytab using transaction spnego or sapgenpse command?
Did you configured the traces? Did you check if your IE/Firefox are well configured?
KR
Valerie