This is the exact thing I'm dealing with with Kerberos and Egroupware. The capabilities of FireFox and IE are different. IE has to use NTLM. (with Apache's mod_auth_ntlm FireFox uses mod_auth_kerb with spnego. To get that working, the site you are connecting to has to be a "Trusted URI" in the nego.trusted-uris configuration of FireFox