[Dovecot] GSS-SPNEGO with dovecot and Outlook without Samba

I am trying to configure a dovecot2 IMAP server to inter-operate with a active directory to authenticate users. The users should be able to login without a password on a domain-joined client(Outlook). Is it possible to do this only with kerberos? I don't want to put a crappy winbind on my mailserver... I already configured my server to authenticate via kerberos(GSSAPI), but Outlook does not even try to authenticate using GSSAPI, it rather uses PLAIN.

I would appreciate any help, many thanks in advance.