kerberos/spnego sso

[John User]

I am having no luck setting up kerberos/spnego sso:
The players:

win2k3 AD box
win xp client running IE 6 and latest firefox
Weblogic 8.1 on a redhat box.
Client trying to access resource on WLS:

tcpdump shows WLS sending "WWW-Authenticate :
Negotiate" in response to request for the protected
resource from IE (and firefox)
Neither IE nor firefox make any attempt to get a
session ticket, - though they do send something
encrtpted back in response. There is no other
WWW-Authenticate header being sent.
klist shows the client machine does have a tgt.
Any hints on how to debug, or has anyone had a similar
experience??
I have gone through all of the basic documented steps:
creation of AD user for WL box, keytabfiles, JAAS
config files... and the various changes on client
browsers. 




__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com