diff --git a/mozilla/extensions/auth/nsAuthGSSAPI.cpp b/mozilla/extensions/auth/nsAuthGSSAPI.cpp
index 3995604d136..d7771d9906e 100644
--- a/mozilla/extensions/auth/nsAuthGSSAPI.cpp
+++ b/mozilla/extensions/auth/nsAuthGSSAPI.cpp
@@ -51,6 +51,10 @@
 #include "nsNegotiateAuth.h"
 #include "nsNegotiateAuthGSSAPI.h"
 
+#ifdef XP_MACOSX
+#include <Kerberos/Kerberos.h>
+#endif
+
 //-----------------------------------------------------------------------------
 
 #if defined( PR_LOGGING )
@@ -219,6 +223,16 @@ nsNegotiateAuth::GetNextToken(const void *inToken,
         Reset();
     }
 
+#if defined(XP_MACOSX)
+    // Suppress Kerberos prompts to get credentials.  See bug 240643.
+    KLBoolean found;
+    if (KLCacheHasValidTickets(NULL, kerberosVersion_V5, &found, NULL, NULL) != klNoErr || !found)
+    {
+        major_status = GSS_S_FAILURE;
+        minor_status = 0;
+    }
+    else
+#endif /* XP_MACOSX */
     major_status = gss_init_sec_context(&minor_status,
                                         GSS_C_NO_CREDENTIAL,
                                         &mCtx,