How to fallback from Negotiate method to Basic only when Negotiate fails

I 开发者_如何学运维have a webapplication which does the kerberos and basic authentication as well. I do not know what the client is capable of. So both auth mechanisms are sent in 401 reply.

The reply header will contain,

WWW-Authenticate: Negotiate
WWW-Authenticate: Basic realm="MyREALM"

But, I want the client to fall back to basic auth only if negotiate fails.

I want the flow should be like,

1. The client request
2. Server responds with WWW-Authenticate: Negotiate
3. The client re-request with (either with wrong auth data or with some flag indicating it can't proceed)
4. The server response again with WWW-Authenticate: Basic realm="MYREALM"
5. Client does basic auth.

How can I do this? I modified the server code to do this. But the browser which is not in any domain (its supposed to do basic auth) does not respond after step2.

---

What is your browser? The specific RFC chapter 4.6 mandates that the browser has to use the strongest auth offered. I cannot recall what the browser should do if it cannot obtain credentials for that.