[AuthenNTLM] AuthenNTLM and Samba domain.

[Pawel Sawicki <pa...@altkom.pl>]

Hello!

I've got a (I think) very strange issue with the AuthenNTLM and my 
Samba-based windows domain.

I'd like to obtain the usual - all domain authenticated users should be 
also authenticated by the apache (which will afterwards allow them to 
use some of our Intranet web applications).

Although there are many reports of similar problems on the web nothing 
really helps in my case. So... I'd like to ask for some help.

The background:

Apache HTTPd - 2.0.54
Apache2::AuthenNTLM - 0.02
Authen::Smb - 0.96
Samba - 3.0.14a-2

[manthios@c-53 ~]$ read -s DOMAIN_PASSWORD
[manthios@c-53 ~]$ smbclient -L //devel -U manthios%${DOMAIN_PASSWORD} 
2>&1 1> /dev/null
Domain=[SOFTWARE] OS=[Unix] Server=[Samba 3.0.10-1.fc2]
Domain=[SOFTWARE] OS=[Unix] Server=[Samba 3.0.10-1.fc2]
[manthios@c-53 ~]$ echo $?
0

Hence the account is ok, I can log in, browse the shares, etc.

Now the httpd.conf:

<Location /ntlm>
         PerlAuthenHandler Apache2::AuthenNTLM
         AuthType ntlm
         AuthName test
         require valid-user

         # I use only one domain, hence SetVar; moreover for the sake of
         # clarity, I've put only pdc
         PerlSetVar ntdomain "software devel"
         PerlSetVar defaultdomain software
         PerlSetVar ntlmsemtimeout 60
         PerlSetVar ntlmsemkey 234523
         PerlSetVar fallbackdomain software
         PerlSetVar splitdomainprefix 1
         PerlSetVar ntlmdebug 2
</Location>

And the problem is that... it doesn't work :/

Here's the error_log from the Apache httpd server taken for a single 
session:

---

[8683] AuthenNTLM: Start NTLM Authen handler pid = 8683, connection = 
154708592 conn_http_hdr = Keep-Alive  main =  cuser =  remote_ip = 
10.29.0.162 remote_port = 13106 remote_host = <> version = 0.02 smbhandle =
[8683] AuthenNTLM: leave lock
[8683] AuthenNTLM: Setup new object
[8683] AuthenNTLM: Config Domain = software  pdc = devel  bdc =
[8683] AuthenNTLM: Config Default Domain = software
[8683] AuthenNTLM: Config Fallback Domain = software
[8683] AuthenNTLM: Config AuthType = ntlm AuthName = test
[8683] AuthenNTLM: Config Auth NTLM = 1 Auth Basic = 0
[8683] AuthenNTLM: Config NTLMAuthoritative = on  BasicAuthoritative = on
[8683] AuthenNTLM: Config Semaphore key = 234523 timeout = 60
[8683] AuthenNTLM: Config SplitDomainPrefix = 1
[8683] AuthenNTLM: Authorization Header <not given>
[Fri Oct 21 15:23:07 2005] [error] Bad/Missing NTLM/Basic Authorization 
Header for /ntlm/
[8686] AuthenNTLM: Start NTLM Authen handler pid = 8686, connection = 
154708592 conn_http_hdr = Keep-Alive  main =  cuser =  remote_ip = 
10.29.0.162 remote_port = 13106 remote_host = <> version = 0.02 smbhandle =
[8686] AuthenNTLM: Setup new object
[8686] AuthenNTLM: Config Domain = software  pdc = devel  bdc =
[8686] AuthenNTLM: Config Default Domain = software
[8686] AuthenNTLM: Config Fallback Domain = software
[8686] AuthenNTLM: Config AuthType = ntlm AuthName = test
[8686] AuthenNTLM: Config Auth NTLM = 1 Auth Basic = 0
[8686] AuthenNTLM: Config NTLMAuthoritative = on  BasicAuthoritative = on
[8686] AuthenNTLM: Config Semaphore key = 234523 timeout = 60
[8686] AuthenNTLM: Config SplitDomainPrefix = 1
[8686] AuthenNTLM: Authorization Header NTLM 
TlRMTVNTUAABAAAAB4IIogAAAAAAAAAAAAAAAAAAAAAFAs4OAAAADw==
[8686] AuthenNTLM: Got: 78 84 76 77 83 83 80 0 1 0 0 0 7 130 8 162 0 0 0 
0 0 0 0 0 0 0 0 0 0 0 0 0 5 2 206 14 0 0 0 15
[8686] AuthenNTLM: protocol=NTLMSSP, type=1, 
flags1=7(NEGOTIATE_UNICODE,NEGOTIATE_OEM,REQUEST_TARGET), 
flags2=130(NEGOTIATE_ALWAYS_SIGN,NEGOTIATE_NTLM), domain length=0, 
domain offset=0, host length=0, host offset=0, host=, domain=
[8686] handler type == 1
[8686] AuthenNTLM: Connect to pdc = devel bdc =  domain = software
[8686] AuthenNTLM: enter lock
[8686] AuthenNTLM: verify handle  smbhandle == 155999112
[8686] AuthenNTLM: Send: 78 84 76 77 83 83 80 0 2 0 0 0 0 0 0 0 40 0 0 0 
1 130 0 0 163 173 115 146 235 200 12 160 0 0 0 0 0 0 0 0
[8686] AuthenNTLM: charencoding = 1
[8686] AuthenNTLM: flags2 = 130
[8686] AuthenNTLM: nonce=£­s’ëÈ 
[8686] AuthenNTLM: Send header: NTLM 
TlRMTVNTUAACAAAAAAAAACgAAAABggAAo61zkuvIDKAAAAAAAAAAAA==
[8686] AuthenNTLM: verify handle = 1 smbhandle == 155999112

---

(This is a record of a session initiated by a windows user.)

To make the matters more complicated... Whenevere I try to login I 
receive a http login screen (how come - "Auth Basic = 0"?) although the 
key point of NTLM is that I shouldn't (I guess).

I had to change the semaphore key number, since with the default one, I 
always received a timeout (no matter how long the timeout really was).

I'd appreciate any kind of help. Even RTFM is ok, as long as the M is 
"the thing" that may help :)

Before I try to hack the code I'd like to know if there is a simple 
answer, that could save me a lot of work (learning NTLM internals).

Thank you in advance.

(I had to use the UTF-8 since log files give such results.)

Best regards,
Pawel Sawicki