NTLM Authentication patch

[Gerald Combs <ge...@ethereal.com>]

We recently installed AuthenNTLM where I work, and ran into the POST
problems described in the thread at

    http://marc.theaimsgroup.com/?t=103177365400006&r=1&w=2

After looking through a couple of network traces I think I've found the
problem.  It appears that after IE authenticates via NTLM, it sends type 1
messages for subsequent requests during a keepalive session.  This is fine
and dandy unless you're sending a POST request - when it sends the type 1
message, it also sends a "Content-length: 0", and doesn't append the POST
data.  Since the browser has successfully authenticated itself earlier in
the keepalive session, AuthenNTLM validates the request and a POST with no
accompanying POST data gets passed to the server.  

Attached is a patch against the 0.21 release that fixes this behavior (in
our environment, at any rate).  I know very little about NTLM
authentication and mod_perl coding, so the patch may not be entirely
correct.

Re: NTLM Authentication patch

[Gerald Richter <ri...@ecos.de>]

> We recently installed AuthenNTLM where I work, and ran into the POST
> problems described in the thread at
>
>     http://marc.theaimsgroup.com/?t=103177365400006&r=1&w=2
>
> After looking through a couple of network traces I think I've found the
> problem.  It appears that after IE authenticates via NTLM, it sends type 1
> messages for subsequent requests during a keepalive session.  This is fine
> and dandy unless you're sending a POST request - when it sends the type 1
> message, it also sends a "Content-length: 0", and doesn't append the POST
> data.  Since the browser has successfully authenticated itself earlier in
> the keepalive session, AuthenNTLM validates the request and a POST with no
> accompanying POST data gets passed to the server.
>

Yes, I have seen the same from traces people have send me, but could not
reproduce it here (my IE always sends the POST data)

I have modified your patch to handle both situations and to have the old
behaviour in case of GET requests (for performance reasons)

I send you the updated version per private mail, please give it a try if it
still works correct for you and let me know. I will release it to CPAN as
soon as somebody who had had the problem reports me that the new version
solves it.

Gerald


-------------------------------------------------------------
Gerald Richter    ecos electronic communication services gmbh
Internetconnect * Webserver/-design/-datenbanken * Consulting

Post:       Tulpenstrasse 5         D-55276 Dienheim b. Mainz
E-Mail:     richter@ecos.de         Voice:    +49 6133 925131
WWW:        http://www.ecos.de      Fax:      +49 6133 925152
-------------------------------------------------------------