sso in spark is accomplished using kerberos, and not native active directory (ntlm). You'll need to jump through a few hoops to get it to work.
I haven't been able to get this to work yet. I have poured over three or four guides and I've built three separate instances of Spark on windows servers from 2003R2 to 2012R2. Success is not yet mine.
I have found that elevating the spark client (right-click, run as administrator) allows access to the principal after following the guide speedy listed.
Maybe my fourth or fifth time will be the charm, because this one is the third and it sure wasn't it.
Most of the time, the issue is with the keytab file and the SPN not matching the xmpp.domain of your server. I'll be around tomorrow (US central time zone). feel free to ping me or jump into the open chat room hosted here.