As for the LDAP extension note that the "AutoAuth" stuff is for smart cards and SSL. If you're looking for SPNEGO where you don't enter a password at all, you can't do that with the LDAP extension (or any other LDAP anything). AFAIK the only extension that does true SPNEGO SSO is our Plexcel product (and mod_auth_kerb but that's not script-level).
Otherwise, you might want to grab the latest LDAP extension files from SVN. I know a lot of changes have been made recently and I'm not sure if they've made it to the Wiki page yet. Check the SVN timestamps in your files.
The SVN version of the LDAP plugin will do web server authentication, and can therefore do any type of authentication your web server can handle, including Kerberos (which Active Directory uses). All you need to know is how to set up your web server.
I'll be adding documentation for various authentication methods soon.
V/r,
Ryan Lane