Spring Security - fallback to basic authentication if Kerberos fails

Question

How can I enable fallback to basic auth if Kerberos authentication fails (e.g. client is not on the domain)? With the configuration below no browser authentication window appears and the following exceptions are thrown:

org.springframework.security.authentication.BadCredentialsException: Kerberos validation not successful
org.ietf.jgss.GSSException: Defective token detected (Mechanism level: GSSHeader did not find the right tag)

Relevant part of my WebSecurityConfigurerAdapter implementation:

 @Override
 protected void configure(HttpSecurity http) throws Exception {
     http
             .exceptionHandling()
             .authenticationEntryPoint(spnegoEntryPoint())
             .and()
             .authorizeRequests()
             .anyRequest()
             .authenticated()
             .and()
             .logout()
             .permitAll()
             .and()
             .addFilterBefore(
                     spnegoAuthenticationProcessingFilter(),
                     BasicAuthenticationFilter.class);
    }

 @Bean
 public SpnegoEntryPoint spnegoEntryPoint() {
     return new SpnegoEntryPoint("/");
 }

@Bean
public SpnegoAuthenticationProcessingFilter spnegoAuthenticationProcessingFilter() {
    SpnegoAuthenticationProcessingFilter filter = new SpnegoAuthenticationProcessingFilter();
    try {
        filter.setAuthenticationManager(authenticationManagerBean());
    } catch (Exception e) {
        log.error("Failed to set AuthenticationManager on SpnegoAuthenticationProcessingFilter.", e);
    }
    return filter;
}