You are viewing a plain text version of this content. The canonical link for it is here.
Posted to modperl@perl.apache.org by william lai <wi...@uniforce.net> on 2004/11/24 03:09:38 UTC
why AuthenNTLM prompt for password/user when user in domain
*Hi speeves,
i'm trying Apache::AuthenNTLM 2.07 modules with a
NT PDC, mod_perl-1.19_12, Apache/2.0.51., After
configuration, i browsers the page that protect by AuthenNTLM and it prompt me for password/user, however it always said the user/passwordis wrong.
is it true that NTLM don't need to enter password/user when user login in the domain?
**and i also set keepalive= on in httpd.conf. I have
searched for a week why it prompt me for password/user, but
stil can't solve.
*
*Do you know what's wrong with my setup?
Here is my .htaccess config:
**********************************
PerlAuthenHandler Apache::AuthenNTLM
AuthName "NTLM Test"
AuthType ntlm
PerlAddVar ntdomain "mypdc.com my-pdc"
PerlSetVar defaultdomain mrppdc.com
PerlSetVar ntlmdebug 2
PerlSetVar splitdomainprefix 1
PerlSetVar ntlmsemtimeout 2
require valid-user
****************************
Here is the log detail.
************************************************************
[[26627] AuthenNTLM: Config Domain = mrppdc.com pdc =
mrp-pdc bdc =
[26627] AuthenNTLM: Config Default Domain = mrppdc.com
[26627] AuthenNTLM: Config Fallback Domain =
[26627] AuthenNTLM: Config AuthType = ntlm AuthName =
NTLM Test
[26627] AuthenNTLM: Config Auth NTLM = 1 Auth Basic =
0
[26627] AuthenNTLM: Config NTLMAuthoritative = on
BasicAuthoritative = on
[26627] AuthenNTLM: Config Semaphore key = 23754
timeout = 2
[26627] AuthenNTLM: Config SplitDomainPrefix = 1
[26627] AuthenNTLM: Authorization Header <not given>
[Wed Nov 24 00:48:18 2004] [error] Bad/Missing
NTLM/Basic Authorization Header for /test/test.html
[26627] AuthenNTLM: Start NTLM Authen handler pid =
26627, connection = 159651528 conn_http_hdr =
Keep-Alive main = cuser = remote_ip = 192.168.59.59
remote_port = remote_host = < > version = 2.07
[26627] AuthenNTLM: Object exists user = \
[26627] AuthenNTLM: Authorization Header NTLM
TlRMTVNTUAABAAAAB4IIoAAAAAAAAAAAAAAAAAAAAAB=
[26627] AuthenNTLM: Got: 78 84 76 77 83 83 80 0 1 0 0
0 7 130 8 160 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
[26627] AuthenNTLM: protocol=NTLMSSP, type=1,
flags1=7(NEGOTIATE_UNICODE,NEGOTIATE_OEM,REQUEST_TARGET),
flags2=130(NEGOTIATE_ALWAYS_SIGN,NEGOTIATE_NTLM),
domain length=0, domain offset=0, host length=0, host
offset=0, host=, domain=
[26627] AuthenNTLM: Connect to pdc = mrp-pdc bdc =
domain = mrppdc.com
[26627] AuthenNTLM: enter lock
[26627] AuthenNTLM: verify handle
[26627] AuthenNTLM: Send: 78 84 76 77 83 83 80 0 2 0 0
0 0 0 0 0 40 0 0 0 1 130 0 0 240 218 235 184 85 9 246
208 0 0 0 0 0 0 0 0
[26627] AuthenNTLM: charencoding = 1
[26627] AuthenNTLM: flags2 = 130
[26627] AuthenNTLM:
nonce=U
[26627] AuthenNTLM: Send header: NTLM
TlRMTVNTUAACAAAAAAAAACgAAAABggAA8NrruFUJ9tAAAAAAAAAAAA==
[26627] AuthenNTLM: Start NTLM Authen handler pid =
26627, connection = 159651528 conn_http_hdr =
Keep-Alive main = cuser = remote_ip = 192.168.59.59
remote_port = remote_host = < > version = 2.07
[26627] AuthenNTLM: Object exists user = \
[26627] AuthenNTLM: Authorization Header NTLM
TlRMTVNTUAADAAAAGAAYAHIAAAAYABgAigAAABQAFABAAAAADgAOAFQAAAAQABAAYgAAAAAAAACiAAAABYIAAG0AcgBwAHAAZABjAC4AYwBvAG0AdwBpAGwAbABpAGEAbQBVAE4ASQBGAE8AUgBDAEUAPhTzJwLTwxsz7ARKvDGplLe7aojbl5LXnRmAu7tZvXtgZvUWM9eVEz6f/oUg/E9P
[26627] AuthenNTLM: Got: 78 84 76 77 83 83 80 0 3 0 0
0 24 0 24 0 114 0 0 0 24 0 24 0 138 0 0 0 20 0 20 0 64
0 0 0 14 0 14 0 84 0 0 0 16 0 16 0 98 0 0 0 0 0 0 0
162 0 0 0 5 130 0 0 109 0 114 0 112 0 112 0 100 0 99 0
46 0 99 0 111 0 109 0 119 0 105 0 108 0 108 0 105 0 97
0 109 0 85 0 78 0 73 0 70 0 79 0 82 0 67 0 69 0 62 20
243 39 2 211 195 27 51 236 4 74 188 49 169 148 183 187
106 136 219 151 146 215 157 25 128 187 187 89 189 123
96 102 245 22 51 215 149 19 62 159 254 133 32 252 79
79
[26627] AuthenNTLM: protocol=NTLMSSP, type=3,
user=william, host=UNIFORCE, domain=mrppdc.com,
msg_len=0
[26627] handler type == 3
[26627] AuthenNTLM: Verify user william via smb server
[26627] AuthenNTLM: NTLM for william,
Y{`f3ו>
OO , via smb server
[26627] AuthenNTLM: leave lock
>>>>>>>>>>>>>>>>>>>>here is the
error>>>>>>>>>>>>>>>>>>>>
[Wed Nov 24 00:48:21 2004] [error] Wrong password/user
(rc=3/1/327681): mrppdc.com\\william for
/test/test.html
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
[26627] AuthenNTLM: rc = 3 ntlmhash =
Y{`f3ו>
*****************************************
thanks,
william lai*
--
Report problems: http://perl.apache.org/bugs/
Mail list info: http://perl.apache.org/maillist/modperl.html
List etiquette: http://perl.apache.org/maillist/email-etiquette.html
Re: why AuthenNTLM prompt for password/user when user in domain
Posted by Shannon Eric Peevey <sp...@erikin.com>.
william lai wrote:
> Hi,
> Thanks for your reply.
> then user/password will promt user/password for the first time
> accessing the page even though user logined, am i right?
Yes.
> Do i need a samba server in apache which use the AuthenNTLM.
No, this module works with both Samba and Windows. (See the docs for
some small differences in configuration).
> And how do i know the the user/usernthash is right between the apache
> and PDC? Since my problem is whatever i enter in the user/password
> prompt, it always says wrong password(rc=3).
>
I would check out these links to help you get down to the packet level
communication:
http://davenport.sourceforge.net/ntlm.html
http://www.innovation.ch/java/ntlm.html
Both of these pages have great information on reading the packet for
information pertinent to NTLM authentication.
BTW, when I look back at your original email, I notice you have
splitdomainprefix set to 1, which will only send username forward to the
domain controller. This was really added to the module to deal with
users that were not part of a domain, or were falling through to another
auth module that didn't need the DOMAIN prefix added to the username.
If you remove this line, then AuthenNTLM will send forward DOMAIN\user,
which should auth correctly for you.
take care,
--
Shannon Eric Peevey
President - EriKin Corporation
speeves@erikin.com
(940) 391-6777
http://www.erikin.com
--
Report problems: http://perl.apache.org/bugs/
Mail list info: http://perl.apache.org/maillist/modperl.html
List etiquette: http://perl.apache.org/maillist/email-etiquette.html
Re: why AuthenNTLM prompt for password/user when user in domain
Posted by william lai <wi...@uniforce.net>.
Hi,
Thanks for your reply.
then user/password will promt user/password for the first time accessing
the page even though user logined, am i right? Do i need a samba server
in apache which use the AuthenNTLM. And how do i know the the
user/usernthash is right between the apache and PDC? Since my problem is
whatever i enter in the user/password prompt, it always says wrong
password(rc=3).
thanks,
william
Shannon Eric Peevey wrote:
> william lai wrote:
>
>> *Hi speeves,
>> i'm trying Apache::AuthenNTLM 2.07 modules with a
>> NT PDC, mod_perl-1.19_12, Apache/2.0.51., After
>
>
> Hi!
>
> Just a note, the newest version of mod_perl is 1.99_17, and Apache
> 2.0.51 had a security hole that is fixed in 2.0.52. (Though I have
> been seeing a mention of a new vulnerability in 2.0.52 on bugtraq,
> though haven't seen it confirmed yet).
>
>> configuration, i browsers the page that protect by AuthenNTLM and it
>> prompt me for password/user, however it always said the
>> user/passwordis wrong.
>> is it true that NTLM don't need to enter password/user when user
>> login in the domain?
>> **and i also set keepalive= on in httpd.conf. I have
>> searched for a week why it prompt me for password/user, but
>> stil can't solve.
>> *
>
>
> If I am understanding this correctly, AuthenNTLM doesn't check for
> existing credentials from IE. It simply checks a local cache to see
> if the user already has a session, then throws a 401 Unauthorized if a
> cached session is not found.
> thanks,
>
--
Report problems: http://perl.apache.org/bugs/
Mail list info: http://perl.apache.org/maillist/modperl.html
List etiquette: http://perl.apache.org/maillist/email-etiquette.html
Re: why AuthenNTLM prompt for password/user when user in domain
Posted by Shannon Eric Peevey <sp...@erikin.com>.
william lai wrote:
> *Hi speeves,
> i'm trying Apache::AuthenNTLM 2.07 modules with a
> NT PDC, mod_perl-1.19_12, Apache/2.0.51., After
Hi!
Just a note, the newest version of mod_perl is 1.99_17, and Apache
2.0.51 had a security hole that is fixed in 2.0.52. (Though I have been
seeing a mention of a new vulnerability in 2.0.52 on bugtraq, though
haven't seen it confirmed yet).
> configuration, i browsers the page that protect by AuthenNTLM and it
> prompt me for password/user, however it always said the
> user/passwordis wrong.
> is it true that NTLM don't need to enter password/user when user login
> in the domain?
> **and i also set keepalive= on in httpd.conf. I have
> searched for a week why it prompt me for password/user, but
> stil can't solve.
> *
If I am understanding this correctly, AuthenNTLM doesn't check for
existing credentials from IE. It simply checks a local cache to see if
the user already has a session, then throws a 401 Unauthorized if a
cached session is not found.
thanks,
--
Shannon Eric Peevey
President - EriKin Corporation
speeves@erikin.com
(940) 391-6777
http://www.erikin.com
--
Report problems: http://perl.apache.org/bugs/
Mail list info: http://perl.apache.org/maillist/modperl.html
List etiquette: http://perl.apache.org/maillist/email-etiquette.html