NTLM not usable if server supports negotiate and NTLM

[antoniusostermann]

Assumptions:

• Server supports NEGOTIATE and NTLM. Thus, the servers response header looks like this:

GET ....
HTTP/1.1 401 Unauthorized
....
WWW-Authenticate: NTLM ...the-key...
WWW-Authenticate: Negotiate

• Client does not support negotiate, wants to use NTLM
• Client uses correct NTLM configuration / parameters / etc

Result:

• Gem uses Negotiate instead of NTLM: https://github.com/savonrb/httpi/blob/master/lib/httpi/adapter/net_http.rb#L95
• It is not possible to force usage of NTLM
• All requests result in a 401 Unauthorized with no further information
• No hint given that client switched to Negotiate automatically

What to change (or to monkeypatch, if anyone does not want this behaviour):

• Force auth_method to become "NTLM", https://github.com/savonrb/httpi/blob/master/lib/httpi/adapter/net_http.rb#L95
• headers["WWW-Authenticate"] will be an array containing two elements: NTLM and the key, and an entry "Negotiate" (see above). Always use that value with the key / with NTLM in it. The gem currently is not able to handle two entries at all. (https://github.com/savonrb/httpi/blob/master/lib/httpi/adapter/net_http.rb#L116)

Since the gem is not able to handle two entries at all, this gem maybe generally doesn't work if server sends negotaite AND ntlm headers (didn't test). If so, this issue contains two kind of things: no possibility to force ntlm, no functionality if server supports both / sends both entries.

[antoniusostermann]

If anyone needs a working patch which a) works if the server responds with NTLM and Negotiate and b) prioritizes NTLM over(!) Negotiate, have a look at this gist: https://gist.github.com/antoniusostermann/11189acf0f200ebb7026

[rogerleite]

Hi @canifex

Thanks for providing such a rich report and the monkey patch.

Do you have any idea how we can implement this on httpi? Maybe the force_ntlm can be one way, feel free to send a pull request.

[lukebergen]

@antoniusostermann I think I may be running into this issue. That gist you reference seems to 404 now though. I don't suppose you remember what it was or still have it that you could re-post it? I know it's a bit of a long shot so no worries if you can't remember or no longer have it.

[antoniusostermann]

@lukebergen Sorry, changed my username in Github meanwhile. You should find the Gist here: https://gist.github.com/antoniusostermann/11189acf0f200ebb7026

Hope it helps.

[coliver]

Hello,

I know its been years on this, but it is still an issue. I'm using httpi 2.4.4. I'm going to try the monkey patch @antoniusostermann posted, but having it fixed in the code base would be ideal. I'll see if I can't come up with a pull request at some point.

[rogerleite]

Hi @coliver! Sorry for the trouble.
All Pull Requests are welcome.

If you need any support to debug, feel free to ask.

This issue is from 2015 ... 👀

[vbrazo]

+1