I love it too, when it works... When it doesn't, the users get the login prompt like the basic auth one, which can be confusing because you have no opportunity to add information to that prompt.

Yeah, users aren't asked about anything, the browser just sends their passwords to whoever asks.

The SSPI part is good, it just uses kerberos. But the full set can be downgraded at any time by the server.