You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@hc.apache.org by ol...@apache.org on 2008/05/11 15:01:03 UTC
svn commit: r655311 - in /httpcomponents/httpclient/trunk: NTLM_SUPPORT.txt
RELEASE_NOTES.txt
Author: olegk
Date: Sun May 11 06:01:02 2008
New Revision: 655311
URL: http://svn.apache.org/viewvc?rev=655311&view=rev
Log:
Added NTLM_SUPPORT.txt document describing steps necessary to NTLM enable Httpclient
Added:
httpcomponents/httpclient/trunk/NTLM_SUPPORT.txt (with props)
Modified:
httpcomponents/httpclient/trunk/RELEASE_NOTES.txt
Added: httpcomponents/httpclient/trunk/NTLM_SUPPORT.txt
URL: http://svn.apache.org/viewvc/httpcomponents/httpclient/trunk/NTLM_SUPPORT.txt?rev=655311&view=auto
==============================================================================
--- httpcomponents/httpclient/trunk/NTLM_SUPPORT.txt (added)
+++ httpcomponents/httpclient/trunk/NTLM_SUPPORT.txt Sun May 11 06:01:02 2008
@@ -0,0 +1,147 @@
+NTLM support in HttpClient 4.x
+==============================
+
+Currently HttpClient 4.0 does not provide support for the NTLM authentication
+scheme out of the box and probably never will. The reasons for that are legal
+rather than technical.
+
+Background
+==========
+NTLM is a proprietary authentication scheme developed by Microsoft and
+optimized for Windows operating system.
+
+Until year 2008 there was no official, publicly available, complete
+documentation of the protocol. Unofficial 3rd party protocol descriptions
+existed [1] as a result of reverse-engineering efforts. It was not really
+known whether the protocol based on the reverse-engineering were complete
+or even correct.
+
+Microsoft published MS-NLMP [2] and MS-NTHT [3] specifications in February
+2008 as a part of its Interoperability Principles initiative [4].
+Unfortunately, it is still not entirely clear whether NTLM encryption
+algorithms are covered by any patents held by Microsoft, which would make
+commercial users of open-source NTLM implementations liable for the use of
+Microsoft intellectual property.
+
+Enabling NTLM support in HttpClient 4.x
+=======================================
+The good news is HttpClient is fully NTLM capable right out of the box.
+HttpClient ships with the NTLM authentication scheme, which, if configured
+to use an external NTLM engine, can handle NTLM challenges and authenticate
+against NTLM servers.
+
+-----------------------------------------------------------
+public interface NTLMEngine {
+
+ String generateType1Msg(
+ String domain,
+ String workstation) throws NTLMEngineException;
+
+ String generateType3Msg(
+ String username,
+ String password,
+ String domain,
+ String workstation,
+ String challenge) throws NTLMEngineException;
+
+}
+-----------------------------------------------------------
+
+Using Samba JCIFS as an NTLM engine
+===================================
+Follow these instructions to build an NTLMEngine implementation using JCIFS
+library
+
+=========== !!!! DISCLAIMER !!!! ===========
+HttpComponents project DOES _NOT_ SUPPORT the code provided below. Use it as
+is at your own discretion.
+
+* Download the latest jcifs library from the Samba web site [5]
+* Implement NTLMEngine interface
+-----------------------------------------------------------
+import jcifs.ntlmssp.Type1Message;
+import jcifs.ntlmssp.Type2Message;
+import jcifs.ntlmssp.Type3Message;
+import jcifs.util.Base64;
+
+import org.apache.http.impl.auth.NTLMEngine;
+import org.apache.http.impl.auth.NTLMEngineException;
+
+public class JCIFSEngine implements NTLMEngine {
+
+ public String generateType1Msg(
+ String domain,
+ String workstation) throws NTLMEngineException {
+
+ Type1Message t1m = new Type1Message(
+ Type1Message.getDefaultFlags(),
+ domain,
+ workstation);
+ return Base64.encode(t1m.toByteArray());
+ }
+
+ public String generateType3Msg(
+ String username,
+ String password,
+ String domain,
+ String workstation,
+ String challenge) throws NTLMEngineException {
+ Type2Message t2m;
+ try {
+ t2m = new Type2Message(Base64.decode(challenge));
+ } catch (IOException ex) {
+ throw new NTLMEngineException("Invalid Type2 message", ex);
+ }
+ Type3Message t3m = new Type3Message(
+ t2m,
+ password,
+ domain,
+ username,
+ workstation);
+ return Base64.encode(t3m.toByteArray());
+ }
+
+}
+-----------------------------------------------------------
+* Implement AuthSchemeFactory interface
+-----------------------------------------------------------
+import org.apache.http.auth.AuthScheme;
+import org.apache.http.auth.AuthSchemeFactory;
+import org.apache.http.impl.auth.NTLMScheme;
+import org.apache.http.params.HttpParams;
+
+public class NTLMSchemeFactory implements AuthSchemeFactory {
+
+ public AuthScheme newInstance(final HttpParams params) {
+ return new NTLMScheme(new JCIFSEngine());
+ }
+
+}
+-----------------------------------------------------------
+* Register NTLMSchemeFactory with the HttpClient instance you want to NTLM
+ enable.
+-----------------------------------------------------------
+ httpclient.getAuthSchemes().register("ntlm", new NTLMSchemeFactory());
+-----------------------------------------------------------
+* Set NTCredentials for the web server you are going to access.
+-----------------------------------------------------------
+ httpclient.getCredentialsProvider().setCredentials(
+ new AuthScope("myserver", -1),
+ new NTCredentials("username", "password", "MYSERVER", "MYDOMAIN"));
+-----------------------------------------------------------
+* You are done.
+
+
+Why this code is not distributed with HttpClient
+================================================
+JCIFS is licensed under the Lesser General Public License (LGPL). This license
+is not compatible with the Apache Licenses under which all Apache Software is
+released. Lawyers of the Apache Software Foundation are currently investigating
+under which conditions Apache software is allowed to make use of LGPL software.
+
+-----------------------------------------------------------
+[1] http://davenport.sourceforge.net/ntlm.html
+[2] http://download.microsoft.com/download/a/e/6/ae6e4142-aa58-45c6-8dcf-a657e5900cd3/%5BMS-NLMP%5D.pdf
+[3] http://download.microsoft.com/download/a/e/6/ae6e4142-aa58-45c6-8dcf-a657e5900cd3/%5BMS-NTHT%5D.pdf
+[4] http://www.microsoft.com/interop/principles/default.mspx
+[5] http://jcifs.samba.org/
Propchange: httpcomponents/httpclient/trunk/NTLM_SUPPORT.txt
------------------------------------------------------------------------------
svn:eol-style = native
Propchange: httpcomponents/httpclient/trunk/NTLM_SUPPORT.txt
------------------------------------------------------------------------------
svn:keywords = Date Author Id Revision HeadURL
Propchange: httpcomponents/httpclient/trunk/NTLM_SUPPORT.txt
------------------------------------------------------------------------------
svn:mime-type = text/plain
Modified: httpcomponents/httpclient/trunk/RELEASE_NOTES.txt
URL: http://svn.apache.org/viewvc/httpcomponents/httpclient/trunk/RELEASE_NOTES.txt?rev=655311&r1=655310&r2=655311&view=diff
==============================================================================
--- httpcomponents/httpclient/trunk/RELEASE_NOTES.txt (original)
+++ httpcomponents/httpclient/trunk/RELEASE_NOTES.txt Sun May 11 06:01:02 2008
@@ -1,3 +1,15 @@
+Changes since 4.0 Alpha 4
+-------------------
+
+* Partial NTLM support (requires an external NTLM engine). For details see
+ NTLM_SUPPORT.txt
+ Contributed by Oleg Kalnichevski <olegk at apache.org>
+
+* Redesigned local execution context management.
+ Contributed by Oleg Kalnichevski <olegk at apache.org>
+
+--------------------------------------
+
Release 4.0 Alpha 4
-------------------
@@ -23,7 +35,9 @@
Changelog:
-------------------
-* [HTTPCLIENT-765] String.toLowerCase() / toUpperCase() should specify Locale.ENGLISH
+* [HTTPCLIENT-765] String.toLowerCase() / toUpperCase() should specify
+ Locale.ENGLISH
+ Contributed by Sebastian Bazley <sebb at apache.org>
* [HTTPCLIENT-769] Do not pool connection marked non-reusable.
Contributed by Oleg Kalnichevski <olegk at apache.org>
Re: svn commit: r655311 - in /httpcomponents/httpclient/trunk:
NTLM_SUPPORT.txt RELEASE_NOTES.txt
Posted by Oleg Kalnichevski <ol...@apache.org>.
On Sun, 2008-05-11 at 19:48 +0100, sebb wrote:
> On 11/05/2008, Oleg Kalnichevski <ol...@apache.org> wrote:
> > On Sun, 2008-05-11 at 15:20 +0100, sebb wrote:
> > > On 11/05/2008, olegk@apache.org <ol...@apache.org> wrote:
> > > > Author: olegk
> > > > Date: Sun May 11 06:01:02 2008
> > > > New Revision: 655311
> > > >
> > > > URL: http://svn.apache.org/viewvc?rev=655311&view=rev
> > > > Log:
> > > > Added NTLM_SUPPORT.txt document describing steps necessary to NTLM enable Httpclient
> > > >
> > >
> > > AFAIK, Sun Java includes NTLM code on Windows only (because of licensing issues)
> > >
> > > Can HTTPClient use the Sun implementation if present?
> > > Or must it use an external implementation?
> > >
> >
> >
> > That would be an option. However, I would like to leave it up to
> > external contributors to provide a solution for. For me the most
> > important thing is that we some sort of functional NTLM auth scheme, so
> > we could go on with the development and move toward finalizing the 4.0
> > API. The JCIFS based stuff is good enough.
> >
>
> That's fine, but not quite what I meant.
>
> Can HttpClient use the Sun Windows NTLM code, or is it restricted to
> using an external provider?
>
I am not sure I understand the distinction. If someone figures out how
to implement NTLMEngine interface using Sun Windows NTLM code shipped
with the JRE, that would be enough. Whether that would be considered
using an internal or external provider, I cannot tell.
Oleg
> > Oleg
> >
> >
> >
> > > ---------------------------------------------------------------------
> > > To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
> > > For additional commands, e-mail: dev-help@hc.apache.org
> > >
> >
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
> > For additional commands, e-mail: dev-help@hc.apache.org
> >
> >
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
> For additional commands, e-mail: dev-help@hc.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
For additional commands, e-mail: dev-help@hc.apache.org
Re: svn commit: r655311 - in /httpcomponents/httpclient/trunk: NTLM_SUPPORT.txt RELEASE_NOTES.txt
Posted by sebb <se...@gmail.com>.
On 11/05/2008, Oleg Kalnichevski <ol...@apache.org> wrote:
> On Sun, 2008-05-11 at 15:20 +0100, sebb wrote:
> > On 11/05/2008, olegk@apache.org <ol...@apache.org> wrote:
> > > Author: olegk
> > > Date: Sun May 11 06:01:02 2008
> > > New Revision: 655311
> > >
> > > URL: http://svn.apache.org/viewvc?rev=655311&view=rev
> > > Log:
> > > Added NTLM_SUPPORT.txt document describing steps necessary to NTLM enable Httpclient
> > >
> >
> > AFAIK, Sun Java includes NTLM code on Windows only (because of licensing issues)
> >
> > Can HTTPClient use the Sun implementation if present?
> > Or must it use an external implementation?
> >
>
>
> That would be an option. However, I would like to leave it up to
> external contributors to provide a solution for. For me the most
> important thing is that we some sort of functional NTLM auth scheme, so
> we could go on with the development and move toward finalizing the 4.0
> API. The JCIFS based stuff is good enough.
>
That's fine, but not quite what I meant.
Can HttpClient use the Sun Windows NTLM code, or is it restricted to
using an external provider?
> Oleg
>
>
>
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
> > For additional commands, e-mail: dev-help@hc.apache.org
> >
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
> For additional commands, e-mail: dev-help@hc.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
For additional commands, e-mail: dev-help@hc.apache.org
Re: svn commit: r655311 - in /httpcomponents/httpclient/trunk:
NTLM_SUPPORT.txt RELEASE_NOTES.txt
Posted by Oleg Kalnichevski <ol...@apache.org>.
On Sun, 2008-05-11 at 15:20 +0100, sebb wrote:
> On 11/05/2008, olegk@apache.org <ol...@apache.org> wrote:
> > Author: olegk
> > Date: Sun May 11 06:01:02 2008
> > New Revision: 655311
> >
> > URL: http://svn.apache.org/viewvc?rev=655311&view=rev
> > Log:
> > Added NTLM_SUPPORT.txt document describing steps necessary to NTLM enable Httpclient
> >
>
> AFAIK, Sun Java includes NTLM code on Windows only (because of licensing issues)
>
> Can HTTPClient use the Sun implementation if present?
> Or must it use an external implementation?
>
That would be an option. However, I would like to leave it up to
external contributors to provide a solution for. For me the most
important thing is that we some sort of functional NTLM auth scheme, so
we could go on with the development and move toward finalizing the 4.0
API. The JCIFS based stuff is good enough.
Oleg
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
> For additional commands, e-mail: dev-help@hc.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
For additional commands, e-mail: dev-help@hc.apache.org
Re: svn commit: r655311 - in /httpcomponents/httpclient/trunk: NTLM_SUPPORT.txt RELEASE_NOTES.txt
Posted by sebb <se...@gmail.com>.
On 11/05/2008, olegk@apache.org <ol...@apache.org> wrote:
> Author: olegk
> Date: Sun May 11 06:01:02 2008
> New Revision: 655311
>
> URL: http://svn.apache.org/viewvc?rev=655311&view=rev
> Log:
> Added NTLM_SUPPORT.txt document describing steps necessary to NTLM enable Httpclient
>
AFAIK, Sun Java includes NTLM code on Windows only (because of licensing issues)
Can HTTPClient use the Sun implementation if present?
Or must it use an external implementation?
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
For additional commands, e-mail: dev-help@hc.apache.org