NTLM has been obsoleted and shouldn't be used at all. SASL/GSSAPI or
SASL/GSS-SPNEGO should be fine.

I understand, but this is a legacy (really legacy) application that can't be changed. Is NTLM still working?