Apache on Windows, SSPI and basic auth
===

I'm running Apache 2.2 with Basic authentication and I want to add SSPI. The goal is to get the following behavior from Apache...

 - In IE (because it passes the Windows Domain credentials): the user is authenticated automatically w/o any dialog box asking for username and password. 
 - For users from other browsers or that are not logged into the corporate network (e.g. Macs not on the domain), they get a dialog to enter their password which could be either their password for the domain or from the file below (one takes precedence I'm sure, but at this point I don't care and I can work around that if its not the order I want or the order isn't consistent). 

Currently in my test environment, the Location section is as follows...

        <IfModule mod_auth_sspi.c>
          <Location /protected/>
            Order deny,allow
            Allow from all
            
            AuthName "My Application Name"
            Require valid-user
        
            ## SSPI (LDAP)
            SSPIAuth On
            SSPIOfferBasic on
            SSPIBasicPreferred On
            SSPIAuthoritative Off
            SSPIDomain adcontroller.mycompany.com
            SSPIOmitDomain On
            SSPIUsernameCase lower
        
            # File
            AuthType Basic 
            AuthBasicAuthoritative Off
            AuthUserFile local_users.txt
          </Location>
        </IfModule>

With this configuration IE works fine, but in non-IE browsers the dialog comes up. But the dialog wont accept username/password combinations from the local_users.txt file. 

Independently, each authentication type works just fine (if I comment out SSPI, the file-based auth works, and commenting out the file-based auth the SSPI works). 

Other configurations I've tested.. 

 - SSPIAuthoritative On: same behavior as above
 - AuthBasicAuthoritative On: same behavior as above
 - SSPIOfferBasic off: same behavior as above, however it seems to validate my user/pass from the file-based auth, and just rejects it (I thought that "require valid-user" would accept any valid user  but I guess not)