Kerberos and NTLM same web application

Question

Good evening, is it possible to have a web application using Kerberos authentication and the extended using NTLM?

Answer 1

Hi @Luiz Gouvea ,

As a workaround, you could extend the web application using Kerberos authentication to another IIS web site. Then for the extended web application, you could choose windows NTLM authentication.

To extend the web application: go to Central Administration-> Application Management-> Manage web applications, selcect the web application and click extend button in the ribbon. Read here for more: extend-a-claims-based-web-application

---

If an Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

SharePoint operates with Negotiate; what this means is if Kerberos fails, NTLM is the fallback. NTLM is always required for Internet-based scenarios where the client cannot contact the KDC, hence using Negotiate in IIS rather than just Kerberos.

As long as you configure the Web App to use Kerberos, you're all set. And of course you should avoid NTLM where ever possible.