You are viewing a plain text version of this content. The canonical link for it is here.
Posted to c-commits@axis.apache.org by ro...@apache.org on 2026/02/05 16:39:25 UTC
(axis-axis2-c-core) branch master updated: Remove NTLM section from SECURITY.md
This is an automated email from the ASF dual-hosted git repository.
robertlazarski pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/axis-axis2-c-core.git
The following commit(s) were added to refs/heads/master by this push:
new f6241f69b Remove NTLM section from SECURITY.md
f6241f69b is described below
commit f6241f69b731efec71751b0592b4ab36ddc0789b
Author: Robert Lazarski <ro...@gmail.com>
AuthorDate: Thu Feb 5 06:20:17 2026 -1000
Remove NTLM section from SECURITY.md
NTLM was completely removed from the codebase, so there's no need
for a dedicated section explaining its removal. The removal is still
documented in the "Removed Features" table.
Renamed "Configuration Example" to "Basic/Digest Configuration Example"
to clarify what authentication method it demonstrates.
Co-Authored-By: Claude Opus 4.5 <no...@anthropic.com>
---
docs/SECURITY.md | 23 +----------------------
1 file changed, 1 insertion(+), 22 deletions(-)
diff --git a/docs/SECURITY.md b/docs/SECURITY.md
index 9a4486a43..c94588038 100644
--- a/docs/SECURITY.md
+++ b/docs/SECURITY.md
@@ -145,28 +145,7 @@ Axis2/C supports HTTP authentication schemes for securing web service communicat
2. **Digest Authentication**: More secure than Basic as passwords are hashed,
but vulnerable to man-in-the-middle without TLS.
-### NTLM Authentication - REMOVED
-
-**NTLM support has been completely removed from Axis2/C.**
-
-Microsoft is deprecating NTLM:
-- [The evolution of Windows authentication](https://techcommunity.microsoft.com/blog/windows-itpro-blog/the-evolution-of-windows-authentication/4478637)
-
-NTLM had critical security vulnerabilities including:
-- Pass-the-hash attacks
-- NTLM relay attacks
-- Weak cryptographic algorithms (MD4/DES based)
-- Session hijacking vulnerabilities
-
-**Recommended alternatives:**
-- **Kerberos** - For Windows/Active Directory environments
-- **OAuth 2.0/OpenID Connect** - For modern web applications
-- **Mutual TLS (mTLS)** - For service-to-service communication
-- **SAML** - For enterprise SSO scenarios
-
-The `--enable-heimdal` and `--enable-libntlm` configure options have been removed.
-
-### Configuration Example
+### Basic/Digest Configuration Example
```xml
<transportSender name="https" class="axis2_http_sender">