Waffle SSO authentication with Basic fallback

Question

I have configured Tomcat SSO authentication with Waffle:

<Context>
  <Valve className="waffle.apache.NegotiateAuthenticator" allowGuestLogin="false"/>
  <Realm className="waffle.apache.WindowsRealm" />
</Context>

This works fine, and supports Negotiate with NTLM fallback.

What I would like is to add BASIC authentication fallback. Is there a way to achieve this?

I have tried this by adding Tomcat's JAASRealm + Waffle's JAAS support (using Tomcat's CombinedRealm), without luck: NegotiateAuthenticator prevented any further processing. (It is looking for the Basic security package, and says "The requested security package does not exist". It does not let the JAASRealm do the job.)