Active Directory does not expose the password attribute, so the user-password-mapper cannot be used. For this reason, only direct-verfication is possible. The authentication mechanisms that perform hashing (Digest, Scram) cannot be used in this mode.

The only solution is to use Basic for HTTP and Plain for Hot Rod

A more secure alternative is to use Kerberos which allows Negotiate and GSSAPI mechanisms