Test SSO with APM

Check the 401 HTTP request message send by your IIS server, what is the value for WWW-authenticate attribute? Should be "Negociate" for Kerberos. For basic's authenticiation the value is "Basic", seems to be the case here for you.

If ok i advise you to activate debug mode for APM, and check if SSO profile is well invoke when you access your website in /var/log/apm.