Hi Johan,
Yes, I was able to fix the problem.
The service principal name of the AD account was incomplete. I already had an entry "SAP/xxxxx" but for SPNEGO "HTTP/xxxxx" entries are required.
Example: HTTP/server.domain.net
After adding those entries SSO via SPNEGO was working.
Regards
Matthias