GSSAPI / Kerberos SSO for IMAP accounts in Outlook 2016?

Hi folks,

 

I'm wondering if there's a way to enable GSSAPI / Kerberos authentication support for IMAP accounts in Outlook 2016 (16.0.4639.1000 or 16.0.8827.2131) for Windows?

 

When advertising GSSAPI, NTLM and GSS-SPNEGO AUTH support from Dovecot:

 

* CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE STARTTLS LOGINDISABLED AUTH=GSSAPI AUTH=GSS-SPNEGO AUTH=NTLM

...Outlook 2016 on a domain-joined Windows 7 host will only choose NTLM authentication at a best case, and only when "Use Secure Password Authentication" is enabled.  It still prompts for a password, which is problematic in a smart card-enabled environment where we're trying to ditch the routine use of passwords.

 

Mozilla Thunderbird, running on this same domain-joined Windows 7 host, is easily configurable for GSSAPI authentication, without having to supply any additional password information.

 

I'm hoping there's some secret registry setting to force Kerberos / GSSAPI authentication for IMAP accounts, buried within Outlook 2016, ala the HKCU\Software\Policies\Microsoft\Office\16.0\outlook\security\AuthenticationService REG_DWORD key for Exchange accounts.

 

Thanks in advance for any ideas out there -

 

Robert