Apache + PAM + sssd + sso pass-through authentication?

Question

Apache HTTP Server

I want to do pass-through authentication using an AD account.
Available:
Debian 9 server, AD domain joined with SSSD/realmd, configured with Kerberos;
An account has been created and a keytab file has been generated. Added SPN records;
Web server: Apache2 (2.4.25-3+deb9u2);
Icinga2 for which everything started;
keytab output:

Keytab name: FILE:/etc/apache2/Apache-Krb.keytab
KVNO Timestamp Principal
---- ------------------- --------- --------------------------------------------------
4 01.01.1970 07 :00:00 HTTP/[email protected] (des-cbc-crc)
4 01/01/1970 07:00:00 HTTP/[email protected] (des-cbc-md5)
4 01/01/1970 07:00:00 HTTP/[email protected] (arcfour-hmac)
4 01/01/1970 07:00:00 HTTP/Apache-Krb [email protected] (aes256-cts-hmac-sha1-96)
4 01/01/1970 07:00:00 HTTP/[email protected] (aes128-cts- hmac-sha1-96)
4 01/01/1970 07:00:00 HTTP/[email protected] (des-cbc-crc)
4 01/01/1970 07:00:00 HTTP/[email protected] (des-cbc-md5)
4 01/01/1970 07:00:00 HTTP/[email protected] CORP.DOMAIN.RU (arcfour-hmac)
4 01/01/1970 07:00:00 HTTP/[email protected] (aes256-cts-hmac-sha1-96)
4 01/01/1970 07 :00:00 HTTP/[email protected] (aes128-cts-hmac-sha1-96)

Rows duplicated due to multiple SPN records
Apache config:

Alias ​​/icingaweb2 "/usr/share/icingaweb2/public"
AuthType Kerberos
AuthName "PAM authentication"
Krb5Keytab /etc/apache2/Apache-Krb.keytab
KrbAuthRealms CORP.DOMAIN.RU
KrbMethodK5Passwd on
Require pam-account apache2-icingaweb2
Options
SymLinksIfOverrideMatch
SetEnv ICINGAWEB_CONFIGDIR "/etc/icingaweb2"
RewriteEngine on
RewriteBase /icingaweb2/
RewriteCond %{REQUEST_FILENAME} -s [OR]
RewriteCond %{REQUEST_FILENAME} -l [OR]
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^.*$ - [NC, L]
RewriteRule ^.*$ index.php [NC,L]
DirectoryIndex error_norewrite.html
ErrorDocument 404 /error_norewrite.html

I go to the page 192.168.0.1/icingaweb2, or corp.domain.ru/icingaweb2 and get the Apache authorization window. I can’t go further than the authorization window and I get a 401 error. I go to the server itself under the domain account [email protected] and there are no problems with authorization.
Tell me which way to drip, where I messed up, what I'm doing wrong.