Iis – How to redirect requests coming on one domain to another domain but with parameters

Since you haven't posted your existing rule (the one that results in redirect looping), I can't tell you why it doesn't work. I can tell you what should work though:

<rule name="Rewrite all but one subdomain" stopProcessing="true">
  <match url="domain.com" />
  <conditions logicalGrouping="matchAll">
    <add input="{HTTP_HOST}" negate="true" pattern="^x.domain\.com$" />
    <add input="{HTTP_HOST}" negate="true" pattern="^domain\.com$" />
  </conditions>
  <action type="Redirect" url="http://domain.com/a/" appendQueryString="false" />
</rule>

<rule name="Rewrite domain requests" stopProcessing="true">
  <match url="domain.com" />
  <conditions logicalGrouping="matchAll">
    <add input="{HTTP_HOST}" pattern="^domain\.com$" />
    <add input="{PATH_INFO}" pattern="^/a/$" negate="true" />
  </conditions>
  <action type="Redirect" url="http://domain.com/a/" appendQueryString="false" />
</rule>

Here we have to rules, one to rewrite all requests where the url matches domain.com except for host headers exactly matching x.domain.com and domain.com (to avoid looping).

The second rule matches requests for exactly domain.com and to any other place than /a/ and redirects them if necessary

I can see two possibilities, NTLM is not supported with URL rewrite + ARR. For Windows integrated authentication you may have to configure Kerberos to get it working properly.

Here's a page describing the general steps for sharepoint, but it's applicable elsewhere: http://blogs.msdn.com/b/echarran/archive/2010/02/11/howto-configure-sharepoint-2010-for-kerberos.aspx

From a deep dive in the article, you have to create Service Principal Names for the web applications and delegate control to the web application identity. To create the SPN, use a command like this: (HTTP applies for both HTTP and HTTPS)

setspn -s HTTP/[domain name of application] [domain name]\[server name hosting application]

Set an SPN for each domain you will need to authenticate to and for each server the applications are hosted on (if you have a web farm). Next, open up active directory and set the view to advanced mode. Open up the computer object for one of the web servers. Go to the delegation tab. Change the radio button to "Trust this user for delegation to specified services only", make sure the next radio button is "Use any authentication protocol". Click Add. search for the application pool identities (if it's Network Service, you don't have to worry about this part). click ok. On add services, select all of them that this application pool identity is in charge of and click okay.

Alternatively, it may be easier to just make a default page on the root that will redirect traffic to the proper location, something like this:

Response.Redirect("http://" + Request.Url.ServerName + "/WebSite" + Request.Url.PathAndQuery);

Set up the custom errors on the default site to use this page. I'll do some testing, but you may have to make another page for errors that uses the referral URI's PathAndQuery to send it to the right place.