# NTLM Authentication to Backend (Windows IIS)

**URL:** <https://discourse.haproxy.org/t/ntlm-authentication-to-backend-windows-iis/8082>\
**Category:** Help!\
**Created:** [November 3, 2022, 6:50pm UTC](https://discourse.haproxy.org/t/ntlm-authentication-to-backend-windows-iis/8082 "2022-11-03T18:50:44Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![notreallyanengineer](https://avatars.discourse-cdn.com/v4/letter/n/858c86/32.png) [@notreallyanengineer](https://discourse.haproxy.org/u/notreallyanengineer)\
**Post date:** [November 3, 2022, 6:50pm UTC](https://discourse.haproxy.org/t/ntlm-authentication-to-backend-windows-iis/8082/1 "2022-11-03T18:50:44Z")

</div>

I am trying to determine how to do a health check against backend servers in HAProxy with NTLM authentication (Windows IIS servers). As I understand, it is ‘multistage’ in that it will do a ‘basic’ auth first, return a 401, and then try again with different headers.

This is baked into the http monitor in f5’s BIGIP as I recently learned, it tries basic auth first, and then failing that attempts NTLM. Is there a way to mimick this in HA-Proxy?

---

<div class="post-metadata">

**Author:** ![AaronWest](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.haproxy.org/aaronwest/32/164_2.png) [@AaronWest](https://discourse.haproxy.org/u/AaronWest)\
**Post date:** [November 4, 2022, 9:12pm UTC](https://discourse.haproxy.org/t/ntlm-authentication-to-backend-windows-iis/8082/2 "2022-11-04T21:12:46Z")

</div>

The external health check might be one way, obviously in theory it allows you to script whatever check you want!

I can imagine how it might be done for sure.

If HAProxy has a better way I’ll let others weigh in…

---

<div class="post-metadata">

**Author:** ![Markus](https://avatars.discourse-cdn.com/v4/letter/m/b782af/32.png) [@Markus](https://discourse.haproxy.org/u/Markus)\
**Post date:** [November 8, 2022, 8:24am UTC](https://discourse.haproxy.org/t/ntlm-authentication-to-backend-windows-iis/8082/3 "2022-11-08T08:24:13Z")

</div>

on which plattform do you run HAProxy? Linux?

You can use msnt\_auth from Samba

[https://www.samba.org/samba/docs/current/man-html/ntlm\_auth.1.html](https://www.samba.org/samba/docs/current/man-html/ntlm_auth.1.html)

add this to you health-check script.

markus