code: public static NtlmPasswordAuthentication authenticate(
              HttpServletRequest req, HttpServletResponse resp, byte[] challenge)
                      throws IOException, ServletException {
          String msg = req.getHeader("Authorization");
          if (msg != null && msg.startsWith("NTLM ")) {
              byte[] src = Base64.decode(msg.substring(5));
              if (src[8] == 1) {
                  Type1Message type1 = new Type1Message(src);
                  Type2Message type2 = new Type2Message(type1, challenge, null);
                  msg = Base64.encode(type2.toByteArray());
                  resp.setHeader( "WWW-Authenticate", "NTLM " + msg );
              } else if (src[8] == 3) {
                  Type3Message type3 = new Type3Message(src);
                  byte[] lmResponse = type3.getLMResponse();
                  if (lmResponse == null) lmResponse = new byte[0];
                  byte[] ntResponse = type3.getNTResponse();
                  if (ntResponse == null) ntResponse = new byte[0];
                  return new NtlmPasswordAuthentication(type3.getDomain(),
                          type3.getUser(), challenge, lmResponse, ntResponse);
              }
          } else {
              resp.setHeader("WWW-Authenticate", "NTLM");
          }
          resp.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
          resp.setContentLength(0);
          resp.flushBuffer();
          return null;
      }
docs: Performs NTLM authentication for the servlet request.
  
  @param req The request being serviced.
  @param resp The response.
  @param challenge The domain controller challenge.
  @throws IOException If an IO error occurs.
  @throws ServletException If an error occurs.