We run a Samba4 domain with Linux and Windows clients joined to it. Both the Windows and Linux machines use a Squid proxy that uses both Kerberos and Basic authentication, and for the most part it works. Both Windows and Linux machines can use the Kerberos authentication method if they have a ticket and the user gets correctly authenticated.
However, with machines that are not joined to the domain (and therefore do not have a Kerberos ticket) there is an issue. Although both Linux and Windows clients correctly drop back to using Basic authentication, Windows clients show two consecutive authentication dialogs, even when the correct username and password are submitted the first time. This does not happen with Linux clients.
All machines run Firefox, and this problem occurs on both XP and 7.
After a short debugging session with Wireshark we have determined that Windows clients are attempting to do NTLM authentication first - which fails due to NTLM not being enabled on Squid. The client then correctly does Basic authentication, but even with the correct username and password Squid still returns a 407 Proxy Authentication Required response. This in turn triggers the client to perform another NTLM attempt, followed by a Basic authentication attempt (the second dialog) that succeeds.
Forgot to mention, Squid version 3.1.19, running on Ubuntu 12.04 LTS