So the forum rules ask me not to reply to myself, but … well, I have more information.
The problem is the way Alfresco appears to handle Kerberos SSO authentication on the HTTP level. When Kerberos SSO is enabled, Alfresco stops using the login page and instead uses browser based authentication. This means it sends a "401 Unauthorized" response to the request. This code requires a "WWW-Authenticate" header which tells the client (web browser) what authentication methods are supported. Alfresco sends only ONE authentication method (ignoring any other methods listed in the Authentication chain) – the Negotiate method. Alfresco leaves the body of the "401 Unauthorized" response blank. This means that browsers which don't support Negotiate (or aren't set up correctly, or the user isn't allowed to access etc, etc) can only display a blank page.
So what should Alfresco do? Alfresco could start supporting Basic HTTP authentication as a fallback if username/password authentication schemes are listed in the authentication chain. In this case, the WWW-Authenticate header would list both the Negotiate method and the Basic method. Alternatively (or additionally?) Alfresco should send some kind of message or page when sending a "401 Unauthorized" response. Ideally, it would send the login page. When checking if a user is authenticated, a correct cookie should be sufficient and the Basic login credentials would be as well.
