The service account the plugin uses to communicate with SharePoint must be a NTLM account as the custom SharePoint permission checker web service requires this. This could be changed to allow a forms based authentication (FBA) account within SharePoint instead. Note that this does not prevent users logged into Confluence whose account within SharePoint is a FBA account from using the sp-list macro. This works so long as the service account can go through a NTLM connection. Prior to this fix this requires extending the web application within SharePoint to have a NTLM URL/port and a FBA URL/port.