Re: CXF and NTLM on Java 6

[metatech <me...@gmail.com>]

frantisek.kocun@gmail.com wrote
> 
> So if you set default Authentificator getPasswordAuthentication() is never
> called?
> 

Beware that the HTTP Keep-Alive option is enabled by default in CXF, which
uses the JVM HttpURLConnection, which itself caches connection for 5 seconds
(see class sun.net.www.http.KeepAliveCache).  A disposed connection on which
an NTLM authentication has already performed can be added to the pool and be
reused later, therefore reusing the existing credentials.

metatech.



--
View this message in context: http://cxf.547215.n5.nabble.com/CXF-and-NTLM-on-Java-6-tp4263002p5708408.html
Sent from the cxf-user mailing list archive at Nabble.com.

Re: CXF and NTLM on Java 6

[metatech <me...@gmail.com>]

frantisek.kocun@gmail.com wrote
> 
> So if you set default Authentificator getPasswordAuthentication() is never
> called?
> 

For the record, there is also another layer of credentials caching in
classes sun.net.www.protocol.http.AuthCacheImpl and
sun.net.www.protocol.http.AuthenticationInfo.
On top of that, CXF also registers its own CXFAuthenticator using
Authenticator.setDefault, so only the last registered Authenticator (the CXF
one or your custom one) will win and will actually be called by the JVM HTTP
stack.

metatech



--
View this message in context: http://cxf.547215.n5.nabble.com/CXF-and-NTLM-on-Java-6-tp4263002p5708496.html
Sent from the cxf-user mailing list archive at Nabble.com.