Hi Evgeniy
We had this issue initially. My SAP GUI SSO with CommonCypto and Kerbose works fine but Web Gui/NWBC had issue.
We found the issue caused due to wrong SPN. We have to create SPN as http/<server name + FQDN>
Please check if your AD admin setup this precisely.
I hope this helps.
Thank you
Santosh.