You are viewing a plain text version of this content. The canonical link for it is here.
Posted to httpclient-users@hc.apache.org by Daz DeBoer <da...@gradleware.com> on 2012/12/12 17:28:21 UTC
Problems with NTLM proxy authentication and SystemDefaultHttpClient
Hi
First of all thanks for the great library. As a core Gradle developer,
I really appreciate the power and flexibility that comes with
HttpClient. (Gradle made the switch from java.net.URL based
downloading to using HttpClient over a year ago.)
While it seems to work most of the time, occasionally we have users
who are not able to authenticate to a proxy using NTLM. (We are using
JCIFS-based NTLMEngine). At first I thought this was just a protocol
problem, but working with a user recently I'm not so sure.
This user reports that they are able to authenticate to their proxy
over NTLM with test code using the DefaultHttpClient, but are not able
to using the SystemDefaultHttpClient after setting what look like the
correct properties. They are also unable to use Gradle to authenticate
to the proxy. Since Gradle is using the SystemDefaultHttpClient under
the covers, I'm interested in how this could make a difference, and
whether this could be the cause of this user's problems with Gradle.
The relevant code and output is here:
---------------------------------------------------------------
Using org.apache.http.impl.client.DefaultHttpClient (working)
* Code : https://gist.github.com/77f7f4278612d38cb554
* Logs : https://gist.github.com/42057219f8903f3b92d2
Using org.apache.http.impl.client.SystemDefaultHttpClient
* Code : https://gist.github.com/99f166b73f60176bab39
* Logs : https://gist.github.com/7f2c4af8b6532f8e9d0c
The input proxy credentials are same for both the tests.
----------------------------------------------------------------
I've looked at the code/output but I'm not sure what could be causing
the differences. My suspicion is ProxySelectorRoutePlanner, but I
don't know how that could affect authentication. Any hints?
Thanks
--
Darrell (Daz) DeBoer
Principal Engineer, Gradleware
http://www.gradleware.com
---------------------------------------------------------------------
To unsubscribe, e-mail: httpclient-users-unsubscribe@hc.apache.org
For additional commands, e-mail: httpclient-users-help@hc.apache.org
Re: Problems with NTLM proxy authentication and
SystemDefaultHttpClient
Posted by Oleg Kalnichevski <ol...@apache.org>.
On Wed, 2012-12-12 at 09:28 -0700, Daz DeBoer wrote:
> Hi
> First of all thanks for the great library. As a core Gradle developer,
> I really appreciate the power and flexibility that comes with
> HttpClient. (Gradle made the switch from java.net.URL based
> downloading to using HttpClient over a year ago.)
>
> While it seems to work most of the time, occasionally we have users
> who are not able to authenticate to a proxy using NTLM. (We are using
> JCIFS-based NTLMEngine). At first I thought this was just a protocol
> problem, but working with a user recently I'm not so sure.
>
> This user reports that they are able to authenticate to their proxy
> over NTLM with test code using the DefaultHttpClient, but are not able
> to using the SystemDefaultHttpClient after setting what look like the
> correct properties. They are also unable to use Gradle to authenticate
> to the proxy. Since Gradle is using the SystemDefaultHttpClient under
> the covers, I'm interested in how this could make a difference, and
> whether this could be the cause of this user's problems with Gradle.
>
> The relevant code and output is here:
> ---------------------------------------------------------------
>
> Using org.apache.http.impl.client.DefaultHttpClient (working)
> * Code : https://gist.github.com/77f7f4278612d38cb554
> * Logs : https://gist.github.com/42057219f8903f3b92d2
>
> Using org.apache.http.impl.client.SystemDefaultHttpClient
> * Code : https://gist.github.com/99f166b73f60176bab39
> * Logs : https://gist.github.com/7f2c4af8b6532f8e9d0c
>
> The input proxy credentials are same for both the tests.
> ----------------------------------------------------------------
>
> I've looked at the code/output but I'm not sure what could be causing
> the differences. My suspicion is ProxySelectorRoutePlanner, but I
> don't know how that could affect authentication. Any hints?
>
> Thanks
Hi Daz
ProxySelectorRoutePlanner appears to be the most likely culprit but I
cannot spot anything obviously wrong from the logs. My recommendation
would be to stop using SystemDefaultHttpClient (it will be deprecated in
4.3 anyway) and apply system settings selectively once by one in order
to narrow down possible causes.
I'll try to have a closer look at the logs in the coming days.
Oleg
---------------------------------------------------------------------
To unsubscribe, e-mail: httpclient-users-unsubscribe@hc.apache.org
For additional commands, e-mail: httpclient-users-help@hc.apache.org
Re: Problems with NTLM proxy authentication and SystemDefaultHttpClient
Posted by Daz DeBoer <da...@gradleware.com>.
On 17 December 2012 13:59, Oleg Kalnichevski <ol...@apache.org> wrote:
> ...
>
>> >
>> > Hi Daz
>> >
>> > I may have found the culprit. Could you please see if the
>> > 'http.keepAlive' system property on your system is set to anything other
>> > than 'true'?
>> >
>>
>> The user has confirmed that NTLM authentication works correctly with
>> "http.keepAlive='true'". When we upgrade Gradle to HttpClient 4.3
>> we'll be sure to correct this issue.
>> Thanks again for helping us track this down, Oleg.
>>
>> cheers
>> Daz
>>
>
> Hi Daz
>
> The problem will also be fixed in 4.2.3 which is planned for early
> January.
>
> Oleg
>
Great! Depending on how early in January, we might be able to include
4.2.3 in Gradle 1.4. Planned RC1 date is around Jan 7, I think.
Daz
---------------------------------------------------------------------
To unsubscribe, e-mail: httpclient-users-unsubscribe@hc.apache.org
For additional commands, e-mail: httpclient-users-help@hc.apache.org
Re: Problems with NTLM proxy authentication and
SystemDefaultHttpClient
Posted by Oleg Kalnichevski <ol...@apache.org>.
...
> >
> > Hi Daz
> >
> > I may have found the culprit. Could you please see if the
> > 'http.keepAlive' system property on your system is set to anything other
> > than 'true'?
> >
>
> The user has confirmed that NTLM authentication works correctly with
> "http.keepAlive='true'". When we upgrade Gradle to HttpClient 4.3
> we'll be sure to correct this issue.
> Thanks again for helping us track this down, Oleg.
>
> cheers
> Daz
>
Hi Daz
The problem will also be fixed in 4.2.3 which is planned for early
January.
Oleg
---------------------------------------------------------------------
To unsubscribe, e-mail: httpclient-users-unsubscribe@hc.apache.org
For additional commands, e-mail: httpclient-users-help@hc.apache.org
Re: Problems with NTLM proxy authentication and SystemDefaultHttpClient
Posted by Daz DeBoer <da...@gradleware.com>.
On 13 December 2012 09:24, Oleg Kalnichevski <ol...@apache.org> wrote:
> On Wed, 2012-12-12 at 09:28 -0700, Daz DeBoer wrote:
>> Hi
>> First of all thanks for the great library. As a core Gradle developer,
>> I really appreciate the power and flexibility that comes with
>> HttpClient. (Gradle made the switch from java.net.URL based
>> downloading to using HttpClient over a year ago.)
>>
>> While it seems to work most of the time, occasionally we have users
>> who are not able to authenticate to a proxy using NTLM. (We are using
>> JCIFS-based NTLMEngine). At first I thought this was just a protocol
>> problem, but working with a user recently I'm not so sure.
>>
>> This user reports that they are able to authenticate to their proxy
>> over NTLM with test code using the DefaultHttpClient, but are not able
>> to using the SystemDefaultHttpClient after setting what look like the
>> correct properties. They are also unable to use Gradle to authenticate
>> to the proxy. Since Gradle is using the SystemDefaultHttpClient under
>> the covers, I'm interested in how this could make a difference, and
>> whether this could be the cause of this user's problems with Gradle.
>>
>> The relevant code and output is here:
>> ---------------------------------------------------------------
>>
>> Using org.apache.http.impl.client.DefaultHttpClient (working)
>> * Code : https://gist.github.com/77f7f4278612d38cb554
>> * Logs : https://gist.github.com/42057219f8903f3b92d2
>>
>> Using org.apache.http.impl.client.SystemDefaultHttpClient
>> * Code : https://gist.github.com/99f166b73f60176bab39
>> * Logs : https://gist.github.com/7f2c4af8b6532f8e9d0c
>>
>> The input proxy credentials are same for both the tests.
>> ----------------------------------------------------------------
>>
>> I've looked at the code/output but I'm not sure what could be causing
>> the differences. My suspicion is ProxySelectorRoutePlanner, but I
>> don't know how that could affect authentication. Any hints?
>>
>> Thanks
>
>
>
> Hi Daz
>
> I may have found the culprit. Could you please see if the
> 'http.keepAlive' system property on your system is set to anything other
> than 'true'?
>
The user has confirmed that NTLM authentication works correctly with
"http.keepAlive='true'". When we upgrade Gradle to HttpClient 4.3
we'll be sure to correct this issue.
Thanks again for helping us track this down, Oleg.
cheers
Daz
---------------------------------------------------------------------
To unsubscribe, e-mail: httpclient-users-unsubscribe@hc.apache.org
For additional commands, e-mail: httpclient-users-help@hc.apache.org
Re: Problems with NTLM proxy authentication and SystemDefaultHttpClient
Posted by Daz DeBoer <da...@gradleware.com>.
Thanks for looking into it.
I'll ask the user to see if he can test this. Unfortunately I'm
relaying this issue, and don't have direct access to reproduce.
Daz
On 13 December 2012 09:24, Oleg Kalnichevski <ol...@apache.org> wrote:
> On Wed, 2012-12-12 at 09:28 -0700, Daz DeBoer wrote:
>> Hi
>> First of all thanks for the great library. As a core Gradle developer,
>> I really appreciate the power and flexibility that comes with
>> HttpClient. (Gradle made the switch from java.net.URL based
>> downloading to using HttpClient over a year ago.)
>>
>> While it seems to work most of the time, occasionally we have users
>> who are not able to authenticate to a proxy using NTLM. (We are using
>> JCIFS-based NTLMEngine). At first I thought this was just a protocol
>> problem, but working with a user recently I'm not so sure.
>>
>> This user reports that they are able to authenticate to their proxy
>> over NTLM with test code using the DefaultHttpClient, but are not able
>> to using the SystemDefaultHttpClient after setting what look like the
>> correct properties. They are also unable to use Gradle to authenticate
>> to the proxy. Since Gradle is using the SystemDefaultHttpClient under
>> the covers, I'm interested in how this could make a difference, and
>> whether this could be the cause of this user's problems with Gradle.
>>
>> The relevant code and output is here:
>> ---------------------------------------------------------------
>>
>> Using org.apache.http.impl.client.DefaultHttpClient (working)
>> * Code : https://gist.github.com/77f7f4278612d38cb554
>> * Logs : https://gist.github.com/42057219f8903f3b92d2
>>
>> Using org.apache.http.impl.client.SystemDefaultHttpClient
>> * Code : https://gist.github.com/99f166b73f60176bab39
>> * Logs : https://gist.github.com/7f2c4af8b6532f8e9d0c
>>
>> The input proxy credentials are same for both the tests.
>> ----------------------------------------------------------------
>>
>> I've looked at the code/output but I'm not sure what could be causing
>> the differences. My suspicion is ProxySelectorRoutePlanner, but I
>> don't know how that could affect authentication. Any hints?
>>
>> Thanks
>
>
>
> Hi Daz
>
> I may have found the culprit. Could you please see if the
> 'http.keepAlive' system property on your system is set to anything other
> than 'true'?
>
> Oleg
>
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: httpclient-users-unsubscribe@hc.apache.org
> For additional commands, e-mail: httpclient-users-help@hc.apache.org
>
--
Darrell (Daz) DeBoer
Principal Engineer, Gradleware
http://www.gradleware.com
---------------------------------------------------------------------
To unsubscribe, e-mail: httpclient-users-unsubscribe@hc.apache.org
For additional commands, e-mail: httpclient-users-help@hc.apache.org
Re: Problems with NTLM proxy authentication and
SystemDefaultHttpClient
Posted by Oleg Kalnichevski <ol...@apache.org>.
On Wed, 2012-12-12 at 09:28 -0700, Daz DeBoer wrote:
> Hi
> First of all thanks for the great library. As a core Gradle developer,
> I really appreciate the power and flexibility that comes with
> HttpClient. (Gradle made the switch from java.net.URL based
> downloading to using HttpClient over a year ago.)
>
> While it seems to work most of the time, occasionally we have users
> who are not able to authenticate to a proxy using NTLM. (We are using
> JCIFS-based NTLMEngine). At first I thought this was just a protocol
> problem, but working with a user recently I'm not so sure.
>
> This user reports that they are able to authenticate to their proxy
> over NTLM with test code using the DefaultHttpClient, but are not able
> to using the SystemDefaultHttpClient after setting what look like the
> correct properties. They are also unable to use Gradle to authenticate
> to the proxy. Since Gradle is using the SystemDefaultHttpClient under
> the covers, I'm interested in how this could make a difference, and
> whether this could be the cause of this user's problems with Gradle.
>
> The relevant code and output is here:
> ---------------------------------------------------------------
>
> Using org.apache.http.impl.client.DefaultHttpClient (working)
> * Code : https://gist.github.com/77f7f4278612d38cb554
> * Logs : https://gist.github.com/42057219f8903f3b92d2
>
> Using org.apache.http.impl.client.SystemDefaultHttpClient
> * Code : https://gist.github.com/99f166b73f60176bab39
> * Logs : https://gist.github.com/7f2c4af8b6532f8e9d0c
>
> The input proxy credentials are same for both the tests.
> ----------------------------------------------------------------
>
> I've looked at the code/output but I'm not sure what could be causing
> the differences. My suspicion is ProxySelectorRoutePlanner, but I
> don't know how that could affect authentication. Any hints?
>
> Thanks
Hi Daz
I may have found the culprit. Could you please see if the
'http.keepAlive' system property on your system is set to anything other
than 'true'?
Oleg
---------------------------------------------------------------------
To unsubscribe, e-mail: httpclient-users-unsubscribe@hc.apache.org
For additional commands, e-mail: httpclient-users-help@hc.apache.org