Apache module mod_authnz_sspi.so needs undocumented settings to force kerberos authentication:
SSPIPackage Negotiate SSPIPerRequestAuth On