title: Browser sends NTLM ticket instead of Kerberos ticket
body: <p>I'm having a problem that's driving me nuts. I'm trying to achive single sign-on on a combination of windows server 2012 as active directory server, ubuntu 12.04 with apache as webserver and a windows 7 laptop as client (all 3 on the same local network). I think I've set up everything correct: </p>
  
  <ul>
  <li><p>I've made a keytab file on the AD-server and when using this from the kinit command on the webserver I get no errors and I can confirm that the kerberos ticket is received using the klist afterwards. </p></li>
  <li><p>I've setup the AD-realm in the krb5.conf file on the webserver and since kinit works I asume that this is done correctly. </p></li>
  <li><p>The protected directory I'm testing on is setup in apache2.conf as follows:<br>
  AuthType Kerberos<br>
  KrbMethodNegotiate On<br>
  KrbMethodK5Passwd On<br>
  KrbAuthRealms ADREALM.LOCAL<br>
  Krb5KeyTab /etc/apache2/test.keytab<br>
  KrbServiceName NameOfSPNInKeyTabFile<br>
  Require valid-user</p></li>
  <li><p>The laptop has been added to the AD-server and after logging on to it there are 3 KerbTickets listed when executing klist.</p></li>
  <li><p>I've added the ip-address of the webserver to the list of trusted sites in IE 11 (both http and https).</p></li>
  </ul>
  
  <p>Still, when I try to access the protected site on the webserver I keep getting a box asking for login and password. When I type these in I get authenticated and get access to the site. </p>
  
  <p>Using WireShark I can se that the client first sends an NTLM ticket when asked for authentication. Since the webserver expects a kerberos-ticket this fails and the browser fall-back to simple authentication asking for login and password. When these are received, the webserver contacts the AD-server and verifies the credentials. So the authentication works - it's just single sign-on that fails.</p>
  
  <p>So the big question is: Why is the browser sending an NTLM-ticket in this situation? I've tested this with both ie, firefox and chrome and they all return an NTLM-ticket. I've tried different combinations of SPN-names, but all with the same result. Are there some naming conventions I've missed or what else could be wrong?</p>