You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@cxf.apache.org by "Alexander Suter (Jira)" <ji...@apache.org> on 2024/09/11 12:11:00 UTC
[jira] [Updated] (CXF-9056) NTML Login ends up with Authorization loop detected after upgrading CXF from 3.5 to 3.6
[ https://issues.apache.org/jira/browse/CXF-9056?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Alexander Suter updated CXF-9056:
---------------------------------
Description:
After upgrading cxf from 3.5 to 3.6 we can no longer authenticate with NTLM with CXF as web service client technology.
We do support two modes in our product. With Challenge and without challenge. And the case without challenge (challenge = false) is no longer working whereas the authentication will be set on the httpConduit directly.
{code:java}
public class NTLMAuthenticationFeature implements WebServiceClientFeature {
@Override
public void initialize(WebServiceClientFeatureContext context) {
BindingProvider bindingProvider = context.getBindingProvider();
WsProps props = new WsProps(context.getProperties());
Client proxy = ClientProxy.getClient(bindingProvider);
boolean challenge = props.bool(Authentication.NTLM.CHALLENGE).orElse(Boolean.TRUE);
proxy.getRequestContext().put(AsyncHTTPConduit.USE_ASYNC, challenge);
var credentials = createNTCredentials(props);
if (challenge) {
proxy.getRequestContext().put(Credentials.class.getName(), credentials);
}
Conduit conduit = proxy.getConduit();
if (conduit instanceof HTTPConduit httpConduit) {
httpConduit.getClient().setAutoRedirect(true);
}
if (!challenge) {
// this does no longer work
httpConduit.getClient().setAllowChunking(false);
setNtlmAuthHeader(credentials, httpConduit);
}
}
private void setNtlmAuthHeader(NTCredentials credentials, HTTPConduit httpConduit) {
var auth = httpConduit.getAuthorization();
auth.setAuthorizationType("NTLM");
auth.setUserName(credentials.getUserPrincipal().getName());
auth.setPassword(credentials.getPassword());
}
private static NTCredentials createNTCredentials(WsProps properties) {
var username = properties.string(Authentication.USERNAME);
var password = properties.string(Authentication.PASSWORD);
var workstation = properties.string(Authentication.NTLM.WORKSTATION);
var domain = properties.string(Authentication.NTLM.DOMAIN);
return new NTCredentials(username, password, workstation, domain);
}
private static record WsProps(Map<String, Object> props) {
String string(String key) {
return Optional.ofNullable(props.get(key))
.map(String.class::cast)
.orElse(null);
Optional<Boolean> bool(String key) {
return Optional.ofNullable(props.get(key))
.map(String.class::cast)
.filter(Predicate.not(String::isBlank))
.map(Boolean::parseBoolean);
}
}
} {code}
See the error stack trace in the log.
Do you have any hints for this problem?
was:
After upgrading cxf from 3.5 to 3.6 we can no longer authenticate with NTLM with CXF as web service client technology.
We do support two modes in our product. With Challenge and without challenge. And the case without challenge (challenge = false) is no longer working whereas the authentication will be set on the httpConduit directly.
{color:#cc6c1d}public{color}{color:#d9e8f7} {color}{color:#cc6c1d}class{color}{color:#d9e8f7} {color}{color:#1290c3}NTLMAuthenticationFeature{color}{color:#d9e8f7} {color}{color:#cc6c1d}implements{color}{color:#d9e8f7} {color}{color:#80f2f6}WebServiceClientFeature{color}{color:#d9e8f7} {color}{color:#f9faf4}{{color}
{color:#d9e8f7} {color}{color:#a0a0a0}@Override{color}
{color:#d9e8f7} {color}{color:#cc6c1d}public{color}{color:#d9e8f7} {color}{color:#cc6c1d}void{color}{color:#d9e8f7} {color}{color:#1eb540}initialize{color}{color:#f9faf4}({color}{color:#1290c3}WebServiceClientFeatureContext{color}{color:#d9e8f7} {color}{color:#79abff}context{color}{color:#f9faf4}){color}{color:#d9e8f7} {color}{color:#f9faf4}{{color}
{color:#d9e8f7} {color}{color:#80f2f6}BindingProvider{color}{color:#d9e8f7} {color}{color:#f2f200}bindingProvider{color}{color:#d9e8f7} {color}{color:#e6e6fa}={color}{color:#d9e8f7} {color}{color:#79abff}context{color}{color:#e6e6fa}.{color}{color:#a7ec21}getBindingProvider{color}{color:#f9faf4}(){color}{color:#e6e6fa};{color}
{color:#d9e8f7} {color}{color:#1290c3}WsProps{color}{color:#d9e8f7} {color}{color:#f2f200}props{color}{color:#d9e8f7} {color}{color:#e6e6fa}={color}{color:#d9e8f7} {color}{color:#cc6c1d}new{color}{color:#d9e8f7} {color}{color:#a7ec21}WsProps{color}{color:#f9faf4}({color}{color:#79abff}context{color}{color:#e6e6fa}.{color}{color:#a7ec21}getProperties{color}{color:#f9faf4}()){color}{color:#e6e6fa};{color}
{color:#d9e8f7} {color}{color:#80f2f6}Client{color}{color:#d9e8f7} {color}{color:#f2f200}proxy{color}{color:#d9e8f7} {color}{color:#e6e6fa}={color}{color:#d9e8f7} {color}{color:#1290c3}ClientProxy{color}{color:#e6e6fa}.{color}{color:#96ec3f}getClient{color}{color:#f9faf4}({color}{color:#f3ec79}bindingProvider{color}{color:#f9faf4}){color}{color:#e6e6fa};{color}
{color:#d9e8f7} {color}{color:#cc6c1d}boolean{color}{color:#d9e8f7} {color}{color:#f2f200}challenge{color}{color:#d9e8f7} {color}{color:#e6e6fa}={color}{color:#d9e8f7} {color}{color:#f3ec79}props{color}{color:#e6e6fa}.{color}{color:#a7ec21}bool{color}{color:#f9faf4}({color}{color:#80f2f6}Authentication{color}{color:#e6e6fa}.{color}{color:#80f2f6}NTLM{color}{color:#e6e6fa}.{color}{color:#8ddaf8}CHALLENGE{color}{color:#f9faf4}){color}{color:#e6e6fa}.{color}{color:#a7ec21}orElse{color}{color:#f9faf4}({color}{color:#1290c3}Boolean{color}{color:#e6e6fa}.{color}{color:#8ddaf8}TRUE{color}{color:#f9faf4}){color}{color:#e6e6fa};{color}
{color:#d9e8f7} {color}{color:#f3ec79}proxy{color}{color:#e6e6fa}.{color}{color:#80f6a7}getRequestContext{color}{color:#f9faf4}(){color}{color:#e6e6fa}.{color}{color:#80f6a7}put{color}{color:#f9faf4}({color}{color:#1290c3}AsyncHTTPConduit{color}{color:#e6e6fa}.{color}{color:#8ddaf8}USE_ASYNC{color}{color:#e6e6fa},{color}{color:#d9e8f7} {color}{color:#f3ec79}challenge{color}{color:#f9faf4}){color}{color:#e6e6fa};{color}
{color:#d9e8f7} {color}{color:#cc6c1d}var{color}{color:#d9e8f7} {color}{color:#f2f200}credentials{color}{color:#d9e8f7} {color}{color:#e6e6fa}={color}{color:#d9e8f7} {color}{color:#96ec3f}createNTCredentials{color}{color:#f9faf4}({color}{color:#f3ec79}props{color}{color:#f9faf4}){color}{color:#e6e6fa};{color}
{color:#d9e8f7} {color}{color:#cc6c1d}if{color}{color:#d9e8f7} {color}{color:#f9faf4}({color}{color:#f3ec79}challenge{color}{color:#f9faf4}){color}{color:#d9e8f7} {color}{color:#f9faf4}{{color}
{color:#d9e8f7} {color}{color:#f3ec79}proxy{color}{color:#e6e6fa}.{color}{color:#80f6a7}getRequestContext{color}{color:#f9faf4}(){color}{color:#e6e6fa}.{color}{color:#80f6a7}put{color}{color:#f9faf4}({color}{color:#80f2f6}Credentials{color}{color:#e6e6fa}.{color}{color:#cc6c1d}class{color}{color:#e6e6fa}.{color}{color:#a7ec21}getName{color}{color:#f9faf4}(){color}{color:#e6e6fa},{color}{color:#d9e8f7} {color}{color:#f3ec79}credentials{color}{color:#f9faf4}){color}{color:#e6e6fa};{color}
{color:#d9e8f7} {color}{color:#f9faf4}}{color}
{color:#d9e8f7} {color}{color:#80f2f6}Conduit{color}{color:#d9e8f7} {color}{color:#f2f200}conduit{color}{color:#d9e8f7} {color}{color:#e6e6fa}={color}{color:#d9e8f7} {color}{color:#f3ec79}proxy{color}{color:#e6e6fa}.{color}{color:#80f6a7}getConduit{color}{color:#f9faf4}(){color}{color:#e6e6fa};{color}
{color:#d9e8f7} {color}{color:#cc6c1d}if{color}{color:#d9e8f7} {color}{color:#f9faf4}({color}{color:#f3ec79}conduit{color}{color:#d9e8f7} {color}{color:#cc6c1d}instanceof{color}{color:#d9e8f7} {color}{color:#3eabe6}HTTPConduit{color}{color:#d9e8f7} {color}{color:#f2f200}httpConduit{color}{color:#f9faf4}){color}{color:#d9e8f7} {color}{color:#f9faf4}{{color}
{color:#d9e8f7} {color}{color:#f3ec79}httpConduit{color}{color:#e6e6fa}.{color}{color:#a7ec21}getClient{color}{color:#f9faf4}(){color}{color:#e6e6fa}.{color}{color:#a7ec21}setAutoRedirect{color}{color:#f9faf4}({color}{color:#cc6c1d}true{color}{color:#f9faf4}){color}{color:#e6e6fa};{color}
{color:#d9e8f7} {color}{color:#cc6c1d}if{color}{color:#d9e8f7} {color}{color:#f9faf4}({color}{color:#e6e6fa}!{color}{color:#f3ec79}challenge{color}{color:#f9faf4}){color}{color:#d9e8f7} {color}{color:#f9faf4}{{color}
{color:#f9faf4} // this does no longer work{color}
{color:#d9e8f7} {color}{color:#f3ec79}httpConduit{color}{color:#e6e6fa}.{color}{color:#a7ec21}getClient{color}{color:#f9faf4}(){color}{color:#e6e6fa}.{color}{color:#a7ec21}setAllowChunking{color}{color:#f9faf4}({color}{color:#cc6c1d}false{color}{color:#f9faf4}){color}{color:#e6e6fa};{color}
{color:#d9e8f7} {color}{color:#a7ec21}setNtlmAuthHeader{color}{color:#f9faf4}({color}{color:#f3ec79}credentials{color}{color:#e6e6fa},{color}{color:#d9e8f7} {color}{color:#f3ec79}httpConduit{color}{color:#f9faf4}){color}{color:#e6e6fa};{color}
{color:#d9e8f7} {color}{color:#f9faf4}}{color}
{color:#d9e8f7} {color}{color:#f9faf4}}{color}
{color:#d9e8f7} {color}{color:#f9faf4}}{color}
{color:#d9e8f7} {color}{color:#cc6c1d}private{color}{color:#d9e8f7} {color}{color:#cc6c1d}void{color}{color:#d9e8f7} {color}{color:#1eb540}setNtlmAuthHeader{color}{color:#f9faf4}({color}{color:#1290c3}NTCredentials{color}{color:#d9e8f7} {color}{color:#79abff}credentials{color}{color:#e6e6fa},{color}{color:#d9e8f7} {color}{color:#3eabe6}HTTPConduit{color}{color:#d9e8f7} {color}{color:#79abff}httpConduit{color}{color:#f9faf4}){color}{color:#d9e8f7} {color}{color:#f9faf4}{{color}
{color:#d9e8f7} {color}{color:#cc6c1d}var{color}{color:#d9e8f7} {color}{color:#f2f200}auth{color}{color:#d9e8f7} {color}{color:#e6e6fa}={color}{color:#d9e8f7} {color}{color:#79abff}httpConduit{color}{color:#e6e6fa}.{color}{color:#a7ec21}getAuthorization{color}{color:#f9faf4}(){color}{color:#e6e6fa};{color}
{color:#d9e8f7} {color}{color:#f3ec79}auth{color}{color:#e6e6fa}.{color}{color:#a7ec21}setAuthorizationType{color}{color:#f9faf4}({color}{color:#17c6a3}"NTLM"{color}{color:#f9faf4}){color}{color:#e6e6fa};{color}
{color:#d9e8f7} {color}{color:#f3ec79}auth{color}{color:#e6e6fa}.{color}{color:#a7ec21}setUserName{color}{color:#f9faf4}({color}{color:#79abff}credentials{color}{color:#e6e6fa}.{color}{color:#a7ec21}getUserPrincipal{color}{color:#f9faf4}(){color}{color:#e6e6fa}.{color}{color:#80f6a7}getName{color}{color:#f9faf4}()){color}{color:#e6e6fa};{color}
{color:#d9e8f7} {color}{color:#f3ec79}auth{color}{color:#e6e6fa}.{color}{color:#a7ec21}setPassword{color}{color:#f9faf4}({color}{color:#79abff}credentials{color}{color:#e6e6fa}.{color}{color:#a7ec21}getPassword{color}{color:#f9faf4}()){color}{color:#e6e6fa};{color}
{color:#d9e8f7} {color}{color:#f9faf4}}{color}
{color:#d9e8f7} {color}{color:#cc6c1d}private{color}{color:#d9e8f7} {color}{color:#cc6c1d}static{color}{color:#d9e8f7} {color}{color:#1290c3}NTCredentials{color}{color:#d9e8f7} {color}{color:#1eb540}createNTCredentials{color}{color:#f9faf4}({color}{color:#1290c3}WsProps{color}{color:#d9e8f7} {color}{color:#79abff}properties{color}{color:#f9faf4}){color}{color:#d9e8f7} {color}{color:#f9faf4}{{color}
{color:#d9e8f7} {color}{color:#cc6c1d}var{color}{color:#d9e8f7} {color}{color:#f2f200}username{color}{color:#d9e8f7} {color}{color:#e6e6fa}={color}{color:#d9e8f7} {color}{color:#79abff}properties{color}{color:#e6e6fa}.{color}{color:#a7ec21}string{color}{color:#f9faf4}({color}{color:#80f2f6}Authentication{color}{color:#e6e6fa}.{color}{color:#8ddaf8}USERNAME{color}{color:#f9faf4}){color}{color:#e6e6fa};{color}
{color:#d9e8f7} {color}{color:#cc6c1d}var{color}{color:#d9e8f7} {color}{color:#f2f200}password{color}{color:#d9e8f7} {color}{color:#e6e6fa}={color}{color:#d9e8f7} {color}{color:#79abff}properties{color}{color:#e6e6fa}.{color}{color:#a7ec21}string{color}{color:#f9faf4}({color}{color:#80f2f6}Authentication{color}{color:#e6e6fa}.{color}{color:#8ddaf8}PASSWORD{color}{color:#f9faf4}){color}{color:#e6e6fa};{color}
{color:#d9e8f7} {color}{color:#cc6c1d}var{color}{color:#d9e8f7} {color}{color:#f2f200}workstation{color}{color:#d9e8f7} {color}{color:#e6e6fa}={color}{color:#d9e8f7} {color}{color:#79abff}properties{color}{color:#e6e6fa}.{color}{color:#a7ec21}string{color}{color:#f9faf4}({color}{color:#80f2f6}Authentication{color}{color:#e6e6fa}.{color}{color:#80f2f6}NTLM{color}{color:#e6e6fa}.{color}{color:#8ddaf8}WORKSTATION{color}{color:#f9faf4}){color}{color:#e6e6fa};{color}
{color:#d9e8f7} {color}{color:#cc6c1d}var{color}{color:#d9e8f7} {color}{color:#f2f200}domain{color}{color:#d9e8f7} {color}{color:#e6e6fa}={color}{color:#d9e8f7} {color}{color:#79abff}properties{color}{color:#e6e6fa}.{color}{color:#a7ec21}string{color}{color:#f9faf4}({color}{color:#80f2f6}Authentication{color}{color:#e6e6fa}.{color}{color:#80f2f6}NTLM{color}{color:#e6e6fa}.{color}{color:#8ddaf8}DOMAIN{color}{color:#f9faf4}){color}{color:#e6e6fa};{color}
{color:#d9e8f7} {color}{color:#cc6c1d}return{color}{color:#d9e8f7} {color}{color:#cc6c1d}new{color}{color:#d9e8f7} {color}{color:#a7ec21}NTCredentials{color}{color:#f9faf4}({color}{color:#f3ec79}username{color}{color:#e6e6fa},{color}{color:#d9e8f7} {color}{color:#f3ec79}password{color}{color:#e6e6fa},{color}{color:#d9e8f7} {color}{color:#f3ec79}workstation{color}{color:#e6e6fa},{color}{color:#d9e8f7} {color}{color:#f3ec79}domain{color}{color:#f9faf4}){color}{color:#e6e6fa};{color}
{color:#d9e8f7} {color}{color:#f9faf4}}{color}
{color:#d9e8f7} {color}{color:#cc6c1d}private{color}{color:#d9e8f7} {color}{color:#cc6c1d}static{color}{color:#d9e8f7} {color}{color:#cc6c1d}record{color}{color:#d9e8f7} WsProps{color}{color:#f9faf4}({color}{color:#80f2f6}Map{color}{color:#e6e6fa}<{color}{color:#b166da}String{color}{color:#e6e6fa},{color}{color:#d9e8f7} {color}{color:#b166da}Object{color}{color:#e6e6fa}>{color}{color:#d9e8f7} {color}{color:#f2f200}props{color}{color:#f9faf4}){color}{color:#d9e8f7} {color}{color:#f9faf4}{{color}
{color:#d9e8f7} {color}{color:#1290c3}String{color}{color:#d9e8f7} {color}{color:#1eb540}string{color}{color:#f9faf4}({color}{color:#1290c3}String{color}{color:#d9e8f7} {color}{color:#79abff}key{color}{color:#f9faf4}){color}{color:#d9e8f7} {color}{color:#f9faf4}{{color}
{color:#cc6c1d} return{color}{color:#d9e8f7} {color}{color:#1290c3}Optional{color}{color:#e6e6fa}.{color}{color:#96ec3f}ofNullable{color}{color:#f9faf4}({color}{color:#66e1f8}props{color}{color:#e6e6fa}.{color}{color:#80f6a7}get{color}{color:#f9faf4}({color}{color:#79abff}key{color}{color:#f9faf4})){color}
{color:#d9e8f7} {color}{color:#e6e6fa}.{color}{color:#a7ec21}map{color}{color:#f9faf4}({color}{color:#1290c3}String{color}{color:#e6e6fa}.{color}{color:#cc6c1d}class{color}{color:#e6e6fa}::{color}{color:#a7ec21}cast{color}{color:#f9faf4}){color}
{color:#d9e8f7} {color}{color:#e6e6fa}.{color}{color:#a7ec21}orElse{color}{color:#f9faf4}({color}{color:#cc6c1d}null{color}{color:#f9faf4}){color}{color:#e6e6fa};{color}
{color:#d9e8f7} {color}{color:#f9faf4}}{color}
{color:#d9e8f7} {color}{color:#1290c3}Optional{color}{color:#e6e6fa}<{color}{color:#b166da}Boolean{color}{color:#e6e6fa}>{color}{color:#d9e8f7} {color}{color:#1eb540}bool{color}{color:#f9faf4}({color}{color:#1290c3}String{color}{color:#d9e8f7} {color}{color:#79abff}key{color}{color:#f9faf4}){color}{color:#d9e8f7} {color}{color:#f9faf4}{{color}
{color:#d9e8f7} {color}{color:#cc6c1d}return{color}{color:#d9e8f7} {color}{color:#1290c3}Optional{color}{color:#e6e6fa}.{color}{color:#96ec3f}ofNullable{color}{color:#f9faf4}({color}{color:#66e1f8}props{color}{color:#e6e6fa}.{color}{color:#80f6a7}get{color}{color:#f9faf4}({color}{color:#79abff}key{color}{color:#f9faf4})){color}
{color:#d9e8f7} {color}{color:#e6e6fa}.{color}{color:#a7ec21}map{color}{color:#f9faf4}({color}{color:#1290c3}String{color}{color:#e6e6fa}.{color}{color:#cc6c1d}class{color}{color:#e6e6fa}::{color}{color:#a7ec21}cast{color}{color:#f9faf4}){color}
{color:#d9e8f7} {color}{color:#e6e6fa}.{color}{color:#a7ec21}filter{color}{color:#f9faf4}({color}{color:#d9e8f7}Predicate{color}{color:#e6e6fa}.{color}{color:#96ec3f}not{color}{color:#f9faf4}({color}{color:#d9e8f7}String{color}{color:#e6e6fa}::{color}{color:#a7ec21}isBlank{color}{color:#f9faf4})){color}
{color:#d9e8f7} {color}{color:#e6e6fa}.{color}{color:#a7ec21}map{color}{color:#f9faf4}({color}{color:#d9e8f7}Boolean{color}{color:#e6e6fa}::{color}{color:#96ec3f}parseBoolean{color}{color:#f9faf4}){color}{color:#e6e6fa};{color}
{color:#d9e8f7} {color}{color:#f9faf4}}{color}
{color:#d9e8f7} {color}{color:#f9faf4}}{color}
{color:#f9faf4}}{color}
See the error stack trace in the log.
Do you have any hints for this problem?
> NTML Login ends up with Authorization loop detected after upgrading CXF from 3.5 to 3.6
> ---------------------------------------------------------------------------------------
>
> Key: CXF-9056
> URL: https://issues.apache.org/jira/browse/CXF-9056
> Project: CXF
> Issue Type: Bug
> Reporter: Alexander Suter
> Priority: Major
> Attachments: stacktrace.txt
>
>
> After upgrading cxf from 3.5 to 3.6 we can no longer authenticate with NTLM with CXF as web service client technology.
>
> We do support two modes in our product. With Challenge and without challenge. And the case without challenge (challenge = false) is no longer working whereas the authentication will be set on the httpConduit directly.
>
> {code:java}
> public class NTLMAuthenticationFeature implements WebServiceClientFeature {
>
> @Override
> public void initialize(WebServiceClientFeatureContext context) {
> BindingProvider bindingProvider = context.getBindingProvider();
> WsProps props = new WsProps(context.getProperties());
> Client proxy = ClientProxy.getClient(bindingProvider);
>
> boolean challenge = props.bool(Authentication.NTLM.CHALLENGE).orElse(Boolean.TRUE);
> proxy.getRequestContext().put(AsyncHTTPConduit.USE_ASYNC, challenge);
> var credentials = createNTCredentials(props);
> if (challenge) {
> proxy.getRequestContext().put(Credentials.class.getName(), credentials);
> }
> Conduit conduit = proxy.getConduit();
> if (conduit instanceof HTTPConduit httpConduit) {
> httpConduit.getClient().setAutoRedirect(true);
> }
> if (!challenge) {
> // this does no longer work
> httpConduit.getClient().setAllowChunking(false);
> setNtlmAuthHeader(credentials, httpConduit);
> }
> }
> private void setNtlmAuthHeader(NTCredentials credentials, HTTPConduit httpConduit) {
> var auth = httpConduit.getAuthorization();
> auth.setAuthorizationType("NTLM");
> auth.setUserName(credentials.getUserPrincipal().getName());
> auth.setPassword(credentials.getPassword());
> }
> private static NTCredentials createNTCredentials(WsProps properties) {
> var username = properties.string(Authentication.USERNAME);
> var password = properties.string(Authentication.PASSWORD);
> var workstation = properties.string(Authentication.NTLM.WORKSTATION);
> var domain = properties.string(Authentication.NTLM.DOMAIN);
> return new NTCredentials(username, password, workstation, domain);
> }
> private static record WsProps(Map<String, Object> props) {
>
> String string(String key) {
>
> return Optional.ofNullable(props.get(key))
> .map(String.class::cast)
> .orElse(null);
>
> Optional<Boolean> bool(String key) {
> return Optional.ofNullable(props.get(key))
> .map(String.class::cast)
> .filter(Predicate.not(String::isBlank))
> .map(Boolean::parseBoolean);
> }
> }
> } {code}
>
> See the error stack trace in the log.
> Do you have any hints for this problem?
>
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)