docs: protected NtlmPasswordAuthentication negotiate( HttpServletRequest req,
                  HttpServletResponse resp,
                  boolean skipAuthentication ) throws IOException, ServletException {
          UniAddress dc;
          String msg;
          NtlmPasswordAuthentication ntlm = null;
          msg = req.getHeader( "Authorization" );
          boolean offerBasic = enableBasic && (insecureBasic || req.isSecure());
  
          if( msg != null && (msg.startsWith( "NTLM " ) ||
                      (offerBasic && msg.startsWith("Basic ")))) {
              if (msg.startsWith("NTLM ")) {
                  HttpSession ssn = req.getSession();
                  byte[] challenge;
  
                  if( loadBalance ) {
                      NtlmChallenge chal = (NtlmChallenge)ssn.getAttribute( "NtlmHttpChal" );
                      if( chal == null ) {
                          chal = SmbSession.getChallengeForDomain();
                          ssn.setAttribute( "NtlmHttpChal", chal );
                      }
                      dc = chal.dc;
                      challenge = chal.challenge;
                  } else {
                      dc = UniAddress.getByName( domainController, true );
                      challenge = SmbSession.getChallenge( dc );
                  }
  
                  if(( ntlm = NtlmSsp.authenticate( req, resp, challenge )) == null ) {
                      return null;
                  }
                  /* negotiation complete, remove the challenge object */
                  ssn.removeAttribute( "NtlmHttpChal" );
              } else {
                  String auth = new String(Base64.decode(msg.substring(6)),
                          "US-ASCII");
                  int index = auth.indexOf(':');
                  String user = (index != -1) ? auth.substring(0, index) : auth;
                  String password = (index != -1) ? auth.substring(index + 1) :
                          "";
                  index = user.indexOf('\\');
                  if (index == -1) index = user.indexOf('/');
                  String domain = (index != -1) ? user.substring(0, index) :
                          defaultDomain;
                  user = (index != -1) ? user.substring(index + 1) : user;
                  ntlm = new NtlmPasswordAuthentication(domain, user, password);
                  dc = UniAddress.getByName( domainController, true );
              }
              try {
  
                  SmbSession.logon( dc, ntlm );
  
                  if( log.level > 2 ) {
                      log.println( "NtlmHttpFilter: " + ntlm +
                              " successfully authenticated against " + dc );
                  }
              } catch( SmbAuthException sae ) {
                  if( log.level > 1 ) {
                      log.println( "NtlmHttpFilter: " + ntlm.getName() +
                              ": 0x" + jcifs.smb1.util.Hexdump.toHexString( sae.getNtStatus(), 8 ) +
                              ": " + sae );
                  }
                  if( sae.getNtStatus() == sae.NT_STATUS_ACCESS_VIOLATION ) {
                      /* Server challenge no longer valid for
                       * externally supplied password hashes.
                       */
                      HttpSession ssn = req.getSession(false);
                      if (ssn != null) {
                          ssn.removeAttribute( "NtlmHttpAuth" );
                      }
                  }
                  resp.setHeader( "WWW-Authenticate", "NTLM" );
                  if (offerBasic) {
                      resp.addHeader( "WWW-Authenticate", "Basic realm=\"" +
                              realm + "\"");
                  }
                  resp.setStatus( HttpServletResponse.SC_UNAUTHORIZED );
                  resp.setContentLength(0); /* Marcel Feb-15-2005 */
                  resp.flushBuffer();
                  return null;
              }
              req.getSession().setAttribute( "NtlmHttpAuth", ntlm );
          } else {
              if (!skipAuthentication) {
                  HttpSession ssn = req.getSession(false);
                  if (ssn == null || (ntlm = (NtlmPasswordAuthentication)
                              ssn.getAttribute("NtlmHttpAuth")) == null) {
                      resp.setHeader( "WWW-Authenticate", "NTLM" );
                      if (offerBasic) {
                          resp.addHeader( "WWW-Authenticate", "Basic realm=\"" +
                                  realm + "\"");
                      }
                      resp.setStatus( HttpServletResponse.SC_UNAUTHORIZED );
                      resp.setContentLength(0);
                      resp.flushBuffer();
                      return null;
                  }
              }
          }
  
          return ntlm;
      }