使用Kerberos/Spring安全/IE/Active目录“检测到有缺陷的令牌”错误(NTLM而不是Kerberos)

We are having trouble getting Spring Security/Kerberos/AD to work for our web app. Our diagnosis is that our AD server sending an NTLM token (we can tell as it starts with "TlRMTVNT.....") to IE and IE is then sending this to our application and it's failing. Our AD server should be sending a Kerberos/SPNEGO token to IE.We are having trouble getting Spring Security/K