Bug ID 607697: Improve 407 based authentication to allow flexible support for Basic, NTLM and Kerberos

Last Modified: Sep 13, 2023

Affected Product(s):
BIG-IP APM(all modules)

Known Affected Versions:
11.5.4, 11.5.5, 11.5.6, 11.5.7, 11.5.8, 11.5.9, 11.5.10, 11.6.1, 11.6.2, 11.6.3,,,,, 11.6.4, 11.6.5,,,, 12.1.0, 12.1.1, 12.1.2, 12.1.3,,,,,,,, 12.1.4,, 12.1.5,,,, 12.1.6, 13.1.0,,,,,,,,, 13.1.1,,,,, 13.1.3,,,,,,, 13.1.4,, 13.1.5,

Fixed In:

Opened: Jul 28, 2016

Severity: 3-Major


BIG-IP can only identify users based on NTLM Auth credentials, not combined with Kerberos and Basic. Not all clients are capable of NTLM authentication (or behave erratically when HTTPS comes on top like Apple Safari on MacOS) and not all are capable of Kerberos authentication. BIG-IP benefits from the speed and security of Kerberos authentication while leaving the option for the client to fall back to NTLM if the client is not able to present a Kerberos token instead of falling back directly to insecure Basic authentication.


- performance lacks due to the regular authentications happening between the F5 SWG and the Active Directory. All requests for each element get a 407 back for another NTLM authentication that then leads to a communication between the SWG and the AD domain controller. If this were Kerberos the SWG would just need to verify if the Kerberos token is still valid. - If a client does not support NTLM it has no chance to authenticate although it might still support basic authentication.


In APM access policy, APM needs to have an option to authenticate user accounts with a 407 response and offer Kerberos, NTLM and Basic together.



Fix Information


Behavior Change

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips