# HTTP portal with the NTLM auth flow is broken on XC.

**URL:** <https://community.f5.com/t/http-portal-with-the-ntlm-auth-flow-is-broken-on-xc/76837>\
**Category:** Technical Forums\
**Tags:** ntlm, xc\
**Created:** [January 20, 2026, 5:42pm UTC](https://community.f5.com/t/http-portal-with-the-ntlm-auth-flow-is-broken-on-xc/76837 "2026-01-20T17:42:35Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![andresneri1](https://avatars.discourse-cdn.com/v4/letter/a/b5ac83/32.png) [@andresneri1](https://community.f5.com/u/andresneri1)\
**Post date:** [January 20, 2026, 5:42pm UTC](https://community.f5.com/t/http-portal-with-the-ntlm-auth-flow-is-broken-on-xc/76837/1 "2026-01-20T17:42:35Z")

</div>

We are trying to protect an OWA365 portal with XC, but some requests with NTLM authentication show an Error 503 - Service Unavailable message in XC.

I think that is the NTLM auth process because when try the same HTTP GET with “Authorization: Basic” it works fine.

curl -v [https://autodiscover.example.com/autodiscover/autodiscover.xml](https://autodiscover.example.com/autodiscover/autodiscover.xml) -H “Authorization: Basic&nbsp;ZG9tYWluXHVzZXI6UHJ1ZWJhc2RlcGFzc3dvcmQ=”

```auto
< HTTP/2 200<br>< cache-control: private<br>< content-type: text/xml; charset=utf-8<br>< request-id: 00000000-0000-0000-0000-000000000000<br>< server: volt-adc<br><<br><?xml version="1.0" encoding="utf-8"?><br><Autodiscover xmlns="http://schemas.microsoft.com/exchange/autodiscover/responseschema/2006"><br> <Response><br>   <Error Time="20:00:00.0000000" Id="000000000"><br><br>

```

But the browser always fails. First, it responds with a 401 HTTP code. After sending the credentials, XC shows a 503-03 error: ‘Service unavailable’.

```auto
method: GET<br>host: autodiscover.example.com<br>req_path: /autodiscover/autodiscover.xml<br>req_body: —<br>api_endpoint: UNKNOWN<br>scheme: https<br>rsp_code: 503<br>rsp_code_details: upstream_reset_before_response_started{remote_reset}<br><br><br>

```

Do F5-XC have an OWA template or something about the NTLM user portal?

---

<div class="post-metadata">

**Author:** ![Nikoolayy1](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/nikoolayy1/32/3589_2.png) [@Nikoolayy1](https://community.f5.com/u/Nikoolayy1)\
**Post date:** [January 21, 2026, 9:59am UTC](https://community.f5.com/t/http-portal-with-the-ntlm-auth-flow-is-broken-on-xc/76837/2 "2026-01-21T09:59:30Z")

</div>

XC distributed cloud does not support NTLM but it should not as NTLM is end of life from Microsoft . You should switch to kerberos as XC supports this when set to HTTP1.1 for client and server side.

---

<div class="post-metadata">

**Author:** ![andresneri1](https://avatars.discourse-cdn.com/v4/letter/a/b5ac83/32.png) [@andresneri1](https://community.f5.com/u/andresneri1)\
**Post date:** [January 26, 2026, 5:08pm UTC](https://community.f5.com/t/http-portal-with-the-ntlm-auth-flow-is-broken-on-xc/76837/3 "2026-01-26T17:08:11Z")

</div>

Hi Nikoolayy1 !

Thank you for your help. We set the LB (client an server side) to HTTP1.1 and the flow worked fine !

---

<div class="post-metadata">

**Author:** ![Nikoolayy1](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/nikoolayy1/32/3589_2.png) [@Nikoolayy1](https://community.f5.com/u/Nikoolayy1)\
**Post date:** [January 26, 2026, 5:16pm UTC](https://community.f5.com/t/http-portal-with-the-ntlm-auth-flow-is-broken-on-xc/76837/4 "2026-01-26T17:16:32Z")

</div>

This means that you were using WWW-Authenticate set to Negotiate probably and Kerberos is used if available as XC last I worked on it couple of months ago did not support NTLM even with http1.1 set.

[https://learn.microsoft.com/en-us/dotnet/framework/wcf/feature-details/understanding-http-authentication](https://learn.microsoft.com/en-us/dotnet/framework/wcf/feature-details/understanding-http-authentication)