Here is the sample code -- obviously having a kerberos setup is tough to have publicly available -- i've left only the download task since simply changing the config below will trigger failure/success
import UIKit
import Foundation
let URL = "https://some_kerberos_protected_file"
class ViewController: UIViewController, NSURLSessionDelegate, NSURLSessionTaskDelegate, NSURLSessionDataDelegate, NSURLSessionDownloadDelegate {
    private let downloadURL = NSURL(string: URL)!
    private var session: NSURLSession!
    private var downloadTask: NSURLSessionDownloadTask!
   
    override func viewDidLoad() {
        super.viewDidLoad()
       
        navigationItem.rightBarButtonItem = UIBarButtonItem(title: "Download", style: .Plain, target: self, action: "download:")
       
        var config = NSURLSessionConfiguration.defaultSessionConfiguration()
       //let config =  NSURLSessionConfiguration.backgroundSessionConfigurationWithIdentifier("DownloadIdentifier")
        session = NSURLSession(configuration:config, delegate: self, delegateQueue: nil)
       
        downloadTask = session.downloadTaskWithURL(downloadURL)
    }
   
    func download(sender: UIBarButtonItem) {
        downloadTask.resume()
    }
   
    func URLSession(session: NSURLSession, didReceiveChallenge challenge: NSURLAuthenticationChallenge, completionHandler: (NSURLSessionAuthChallengeDisposition, NSURLCredential?) -> Void) {
       
        print("challenged")
        completionHandler(.PerformDefaultHandling, nil)
    }
   
    func URLSession(session: NSURLSession, task: NSURLSessionTask, didReceiveChallenge challenge: NSURLAuthenticationChallenge, completionHandler: (NSURLSessionAuthChallengeDisposition, NSURLCredential?) -> Void) {
        print("Challenged")
        completionHandler(.PerformDefaultHandling, nil)
    }
   
    func URLSession(session: NSURLSession, task: NSURLSessionTask, didCompleteWithError error: NSError?) {
        print("ERROR: \(error)")
    }
        
    func URLSession(session: NSURLSession, dataTask: NSURLSessionDataTask, didReceiveResponse response: NSURLResponse, completionHandler: (NSURLSessionResponseDisposition) -> Void) {
        print("response: \(response)")
        if (response as! NSHTTPURLResponse).statusCode == 401 {
            completionHandler(.Allow)
        } else {
            completionHandler(.BecomeDownload)
        }
    }
   
    func URLSession(session: NSURLSession, dataTask: NSURLSessionDataTask, didBecomeDownloadTask downloadTask: NSURLSessionDownloadTask) {
        print("became download task")
    }
   
    func URLSession(session: NSURLSession, dataTask: NSURLSessionDataTask, didReceiveData data: NSData) {
        print("received data: \(data)")
    }
   
    func URLSession(session: NSURLSession, downloadTask: NSURLSessionDownloadTask, didFinishDownloadingToURL location: NSURL) {
        print("finished downloading: \(location)")
       
        let paths = NSSearchPathForDirectoriesInDomains(NSSearchPathDirectory.DocumentDirectory, NSSearchPathDomainMask.UserDomainMask, true)
       
        do {
            try NSFileManager.defaultManager().moveItemAtURL(location, toURL: NSURL.fileURLWithPath((paths[0] ) + "/output.file"))
        } catch _ {
        }
    }
   
    func URLSession(session: NSURLSession, downloadTask: NSURLSessionDownloadTask, didWriteData bytesWritten: Int64, totalBytesWritten: Int64, totalBytesExpectedToWrite: Int64) {        
        print("progress: \(bytesWritten) of \(totalBytesExpectedToWrite)")
    }
}