diff --git a/src/share/classes/sun/net/www/http/HttpClient.java b/src/share/classes/sun/net/www/http/HttpClient.java
index d0f2e9387181415ecf2b0317bb01b1442876d242..82f3686e1559387953eea51098b4aeb41f2a6d8a 100644
--- a/src/share/classes/sun/net/www/http/HttpClient.java
+++ b/src/share/classes/sun/net/www/http/HttpClient.java
@@ -952,7 +952,11 @@ public class HttpClient extends NetworkClient {
                 pi.setContentType(responses.findValue("content-type"));
             }
 
-            if (isKeepingAlive())   {
+            // If disableKeepAlive == true, the client will not be returned
+            // to the cache. But we still need to use a keepalive stream to
+            // allow the multi-message authentication exchange on the connection
+            boolean useKeepAliveStream = isKeepingAlive() || disableKeepAlive;
+            if (useKeepAliveStream)   {
                 // Wrap KeepAliveStream if keep alive is enabled.
                 logFinest("KeepAlive stream used: " + url);
                 serverInput = new KeepAliveStream(serverInput, pi, cl, this);