[keycloak-user] How to get rid of the basic auth window appearing when logging in on windows machines with SPNEGO / Kerberos login?

Hi, I have a very weird behaviour here. I am using an ldap federation provider and SPNEGO with its respective WWW-Authenticate: Negotiate header to enable auto-login. Now everything worked fine in our staging environments, but in production (damn! there's no pülace like...), there's suddenly a Basic Auth-Window appearing in Chrome (win7) and Edge/Chrome (win10). When pressing "cancel", the auth-call is returning a 401 and falling back to the login page. But: After this, when I re-open the page which should automatically log me in in another tab or in the same tab, it suddenly works. Anyone has some infos about that? I am out of ideas, sadly. Best regards, Dominik