private void ntlmChallenge(
      String authenticateHeader, //
      Request request, //
      HttpHeaders headers, //
      Realm realm, //
      NettyResponseFuture<?> future) {

    if (authenticateHeader.equals("NTLM")) {
      // server replied bare NTLM => we didn't preemptively sent Type1Msg
      String challengeHeader = NtlmEngine.INSTANCE.generateType1Msg();
      // FIXME we might want to filter current NTLM and add (leave other
      // Authorization headers untouched)
      headers.set(HttpHeaders.Names.AUTHORIZATION, "NTLM " + challengeHeader);
      future.getInAuth().set(false);

    } else {
      String serverChallenge = authenticateHeader.substring("NTLM ".length()).trim();
      String challengeHeader =
          NtlmEngine.INSTANCE.generateType3Msg(
              realm.getPrincipal(),
              realm.getPassword(),
              realm.getNtlmDomain(),
              realm.getNtlmHost(),
              serverChallenge);
      // FIXME we might want to filter current NTLM and add (leave other
      // Authorization headers untouched)
      headers.set(HttpHeaders.Names.AUTHORIZATION, "NTLM " + challengeHeader);
    }
  }