Verify Domain User account SPN for the Microsoft Dynamics CRM ASP.NET Application Pool account

"Caller does not have enough privilege to set the CallerOriginToken to the specified value". If you are seeing this error when you try to open your CRM for the first time, then you have tried installing your CRM using your domain account and you have ignored the below given warning message by the EDU during installation .
"Verify Domain User account SPN for the Microsoft Dynamics CRM ASP.NET Application Pool account."

Follow these below steps to resolve it.

1. Using Windows Support Tools, setup the SPNs for the machine and service account (Important: needs to be done first)
   setspn –A HTTP/servername:5555 domain/serviceusername
   setspn –A HTTP/servername.company.com:5555 domain/serviceusername
   
   Note: Don’t forget the PORT
   Note: Don’t forget to do both the FQDN and the NetBios name
2. Trust for Delegation enabled in AD for the Service Account AND CRM Machine
   
   Note: This option is only available after you add the SPN for the both the NetBios name and FQDN) in step #1
3. Verify / add the service account to the CRM installation’s PrivUserGroup
   
   Note: This step must be done after installation. There is a known issue were setup will remove the user used for installation (the "setup user") and if this user is the same as the service account user, it will be missing.
4. The service account needs to be added to the local machines IIS_WPG group
5. Reset your IIS on the server.  OR Restart the CRM server. 

Hope this helps.

Original blog.
http://billoncrmtech.blogspot.com/2008/08/now-i-am-master-tips-for-running-crm-40.html