|
»
»
JCIFS Pops up dialog box for Authenticating certain users
|
View:
New views
13 Messages
—
Rating Filter:
Alert me
|
 |
JCIFS Pops up dialog box for Authenticating certain users
by Vivek Mehtani
::
Rate this Message:
Hi,
We need to configure JCIFS for single sign on silently passing the credentials. For this we have configured the NtlmHttpFilter in the following manner in our web.xml file. The problem we are facing is that for certain users it works perfectly fine but for certain users it pops up a dialog box for the credentials . if the user provides the correct credentials then user gets authenticated. But we would like every user to be authenticated silently. can some one suggest what is wrong in the below configuration that it doesn't work for all users ? <filter-name>NtlmHttpFilter</filter-name> <filter-class>jcifs.http.NtlmHttpFilter</filter-class> <init-param> <param-name>jcifs.smb.client.domain</param-name> <param-value>DOMAIN</param-value> </init-param> <init-param> <param-name>jcifs.http.domainController</param-name> <param-value>IP</param-value> </init-param> <init-param> <param-name>jcifs.util.loglevel</param-name> <param-value>2</param-value> </init-param> <init-param> <param-name>jcifs.smb.lmCompatibility</param-name> <param-value>3</param-value> </init-param> </filter> Thanks Vivek Thanks & Regards, Vivek Mehtani |
|
|
Re: JCIFS Pops up dialog box for Authenticating certain users
by AsafM
::
Rate this Message:
Perhaps the problem is with the browser settings for those users?
How's the log looks like for those users? On Fri, Jul 4, 2008 at 8:31 PM, Vivek Mehtani <vivek.mehtani@...> wrote:
|
|
|
Re: JCIFS Pops up dialog box for Authenticating certain users
by AJ Weber
::
Rate this Message:
Some parts of this message have been removed.
Learn more about Nabble's security policy.
I have found this to be consistent with IE 6+ when
the user is not already authenticated to the domain. For example, a VPN
user can (in some setups) avoid authenticating to the domain from their "home
PC". When that is the case, they will be prompted for
credentials.
Also, if you are using an IP address or some names
it can happen. The best thing is to check that IE has the target
URL/site/host in the "Intranet" or "Trusted Sites" zone first.
-AJ
|
|
|
Re: JCIFS Pops up dialog box for Authenticating certain users
by Vivek Mehtani
::
Rate this Message:
Hi,
I am receiving the following exception NtlmHttpFilter: IP\username: 0xC000006D: jcifs.smb.SmbAuthException: Logon failure: unknown user name or bad password. Thanks, Vivek Mehtani
|
|
|
|
|
|
Re: JCIFS Pops up dialog box for Authenticating certain users
by Michael B Allen
::
Rate this Message:
On 7/9/08, Ti Lian Hwang <lian_hwang.ti@...> wrote:
> > Sorry, I gotta keep refering to this ... > > http://lists.samba.org/archive/jcifs/2008-January/007602.html > > which has worked for me ever since. That's not a "fix" for anything. It just disables reusing transports. Setting jcifs.smb.client.ssnLimit = 1 would work equally well (although we recently fixed a bug that caused an NPE when setting that property to 1). But without transport reuse every authentication has to build up and tear down a socket which completely obliterates scalability and that is the greatest strength of the JCIFS NTLM HTTP Filter. The only known issue regarding the filter is the "hiccup bug" where transports shutdown in the middle of the NTLM exchange thereby invalidating any in-flight nonces. This is likely to be the issue that you are seeing. It's just a bad interaction between the stateful NTLMSSP and stateless HTTP protocols. The proposed fix for this issue is discussed here: http://lists.samba.org/archive/jcifs/2008-June/008019.html However this fix will likely never be incorporated. Is is more likely that the NTLM HTTP Filter in general will be dropped with the release of JCIFS 2.0 (assuming a 2.0 ever happens) because the Filter has nothing to do with the CIFS protocol and, more important, the man-in-the-middle hack the Filter uses will not work with NTLMv2 which is gaining popularity (and it's at the center of the "hiccup" bug). I believe that an OSS project can actually do harm to the community because it can block the development of a proper solution. The JCIFS NTLM HTTP Filter was an easy solution that was very popular and it actually worked very well all things considered. But it's a hack, it's giving JCIFS a bad name and it needs to be put down. I reconnoiter that by removing the NTLM HTTP Filter from JCIFS the community will be forced to act to create a proper SSO Filter for Java Servlet containers. I would be happy to describe how a proper SSO Filter should operate to anyone who is serious about starting such a project. Mike -- Michael B Allen PHP Active Directory SPNEGO SSO http://www.ioplex.com/ |
|
|
|
|
|
Re: JCIFS Pops up dialog box for Authenticating certain users
by Michael B Allen
::
Rate this Message:
On 7/9/08, Ti Lian Hwang <lian_hwang.ti@...> wrote:
> Setting jcifs.smb.client.ssnLimit = 1 > > > does not work when using jcifs.smb.client.username/password > It does NOT cause a NPE, but "Invalid access to memory location." > > Please refer again to > > http://lists.samba.org/archive/jcifs/2008-June/007993.html So did you try 1.2.22+ with jcifs.smb.client.dfs.disabled = true? > > > NTLM HTTP Filter has been so popular and solves a great > problem; it would be sad to see it go. > > OSS has always been about hacks, CIFS is a hack itself. > > > > -----Original Message----- > From: Michael B Allen [mailto:ioplex@...] > Sent: Thursday, July 10, 2008 10:23 AM > To: Ti Lian Hwang > Cc: jcifs@... > Subject: Re: [jcifs] JCIFS Pops up dialog box for Authenticating certain > users > > > On 7/9/08, Ti Lian Hwang <lian_hwang.ti@...> wrote: > > > > Sorry, I gotta keep refering to this ... > > > > http://lists.samba.org/archive/jcifs/2008-January/007602.html > > > > which has worked for me ever since. > > That's not a "fix" for anything. It just disables reusing transports. > Setting jcifs.smb.client.ssnLimit = 1 would work equally well > (although we recently fixed a bug that caused an NPE when setting that > property to 1). But without transport reuse every authentication has > to build up and tear down a socket which completely obliterates > scalability and that is the greatest strength of the JCIFS NTLM HTTP > Filter. > > The only known issue regarding the filter is the "hiccup bug" where > transports shutdown in the middle of the NTLM exchange thereby > invalidating any in-flight nonces. This is likely to be the issue that > you are seeing. It's just a bad interaction between the stateful > NTLMSSP and stateless HTTP protocols. The proposed fix for this issue > is discussed here: > > http://lists.samba.org/archive/jcifs/2008-June/008019.html > > However this fix will likely never be incorporated. Is is more likely > that the NTLM HTTP Filter in general will be dropped with the release > of JCIFS 2.0 (assuming a 2.0 ever happens) because the Filter has > nothing to do with the CIFS protocol and, more important, the > man-in-the-middle hack the Filter uses will not work with NTLMv2 which > is gaining popularity (and it's at the center of the "hiccup" bug). > > I believe that an OSS project can actually do harm to the community > because it can block the development of a proper solution. The JCIFS > NTLM HTTP Filter was an easy solution that was very popular and it > actually worked very well all things considered. But it's a hack, it's > giving JCIFS a bad name and it needs to be put down. > > I reconnoiter that by removing the NTLM HTTP Filter from JCIFS the > community will be forced to act to create a proper SSO Filter for Java > Servlet containers. I would be happy to describe how a proper SSO > Filter should operate to anyone who is serious about starting such a > project. > > Mike > > -- > Michael B Allen > PHP Active Directory SPNEGO SSO > http://www.ioplex.com/ > -- Michael B Allen PHP Active Directory SPNEGO SSO http://www.ioplex.com/ |
|
|
|
|
|
Re: JCIFS Pops up dialog box for Authenticating certain users
by Matt Parker-3
::
Rate this Message:
On Fri, Jul 4, 2008 at 11:31 AM, Vivek Mehtani <vivek.mehtani@...> wrote:
> > Hi, > > We need to configure JCIFS for single sign on silently passing the > credentials. For this we have configured the NtlmHttpFilter in the following > manner in our web.xml file. The problem we are facing is that for certain > users it works perfectly fine but for certain users it pops up a dialog box > for the credentials . if the user provides the correct credentials then user > gets authenticated. > > But we would like every user to be authenticated silently. > > can some one suggest what is wrong in the below configuration that it > doesn't work for all users ? > > <filter-name>NtlmHttpFilter</filter-name> > <filter-class>jcifs.http.NtlmHttpFilter</filter-class> > <init-param> > <param-name>jcifs.smb.client.domain</param-name> > <param-value>DOMAIN</param-value> > </init-param> > <init-param> > <param-name>jcifs.http.domainController</param-name> > <param-value>IP</param-value> > </init-param> > <init-param> > <param-name>jcifs.util.loglevel</param-name> > <param-value>2</param-value> > </init-param> > <init-param> > <param-name>jcifs.smb.lmCompatibility</param-name> > <param-value>3</param-value> > </init-param> > </filter> > > > Thanks > > Vivek > > Thanks & Regards, > > Vivek Mehtani > -- > View this message in context: http://www.nabble.com/JCIFS-Pops-up-dialog-box-for-Authenticating-certain-users-tp18283528p18283528.html > Sent from the Samba - jcifs mailing list archive at Nabble.com. > > I was having this problem as well, until I enabled preauthentication (described here: http://jcifs.samba.org/src/docs/ntlmhttpauth.html#signing). Try adding jcifs.smb.client.username and jcifs.smb.client.password init-params. This is obviously not an ideal solution since you have to put a plaintext domain password in your web.xml, so you'd have to get creative if you wanted it to be more secure. HTH, Matt |
|
|
Re: JCIFS Pops up dialog box for Authenticating certain users
by AsafM
::
Rate this Message:
On Thu, Jul 10, 2008 at 5:22 AM, Michael B Allen <ioplex@...> wrote:
What is "The man-in-middle" hack you are referring to? Why NTLMv2 will prevent the filter from working?
Can you please describe what you're suggesting? What will be the difference between a "proper" Servlet Filter and the current NTLM HTTP Filter? Thank you, Asaf
|
|
|
Re: JCIFS Pops up dialog box for Authenticating certain users
by Kevin Tapperson
::
Rate this Message:
Attached is a diff of the changes that I made to support a reference counter to avoid the "hiccup". This diff was based on JCIFS 1.1.11 (the latest at the time). These changes have been running in a production environment for about 4 years now and have had some serious load testing thrown at them.
On Mon, Jul 14, 2008 at 2:23 AM, Asaf Mesika <asaf.mesika@...> wrote:
-- Kevin >diff jcifs_1.1.11\src\jcifs\smb\SmbSession.java workspace\jcifs\source\jcifs\smb\SmbSession.java 83a84 > trans.incrementReferenceCount(); //KGT 136a138 > trans.incrementReferenceCount(); //KGT 158,164c160,170 < if( LOGON_SHARE == null ) { < tree.treeConnect( null, null ); < } else { < Trans2FindFirst2 req = new Trans2FindFirst2( "\\", "*", SmbFile.ATTR_DIRECTORY ); < Trans2FindFirst2Response resp = new Trans2FindFirst2Response(); < tree.sendTransaction( req, resp ); < } --- > try { //KGT > if( LOGON_SHARE == null ) { > tree.treeConnect( null, null ); > } else { > Trans2FindFirst2 req = new Trans2FindFirst2( "\\", "*", SmbFile.ATTR_DIRECTORY ); > Trans2FindFirst2Response resp = new Trans2FindFirst2Response(); > tree.sendTransaction( req, resp ); > } > } finally { //KGT > tree.session.transport.decrementReferenceCount(); //KGT > } //KGT >diff jcifs_1.1.11\src\jcifs\smb\SmbTransport.java workspace\jcifs\source\jcifs\smb\SmbTransport.java > import java.util.Iterator; 124a126,127 > private int refCount = 0; //KGT > 167c170,171 < LinkedList sessions; --- > //KGT LinkedList sessions; > HashMap sessions; //KGT 201c205,206 < sessions = new LinkedList(); --- > //KGT sessions = new LinkedList(); > sessions = new HashMap(); //KGT 220,227c225,237 < ListIterator iter = sessions.listIterator(); < while( iter.hasNext() ) { < ssn = (SmbSession)iter.next(); < if( ssn.matches( auth )) { < ssn.auth = auth; < return ssn; < } < } --- > //KGT ListIterator iter = sessions.listIterator(); > //KGT while( iter.hasNext() ) { > //KGT ssn = (SmbSession)iter.next(); > //KGT if( ssn.matches( auth )) { > //KGT ssn.auth = auth; > //KGT return ssn; > //KGT } > //KGT } > ssn = (SmbSession)sessions.get( auth ); //KGT > if( ssn != null ) { //KGT > ssn.auth = auth; //KGT > return ssn; //KGT > } //KGT --- > //KGT iter = sessions.listIterator(); > Iterator iter = sessions.values().iterator(); //KGT 245c256,257 < sessions.add( ssn ); --- > //KGT sessions.add( ssn ); > sessions.put( auth, ssn ); //KGT 283c295,296 < ListIterator iter = sessions.listIterator(); --- > //KGT ListIterator iter = sessions.listIterator(); > Iterator iter = sessions.values().iterator(); //KGT 506c519,524 < tryClose( false ); --- > if( refCount == 0 ) { //KGT > tryClose( false ); > } else if( log.level > 1 ) { //KGT > log.println( "soTimeout has occured but there are " + //KGT > refCount + " references to this transport socket" ); //KGT > } //KGT 523a542,549 > synchronized void incrementReferenceCount() { //KGT > refCount++; //KGT > } //KGT > > synchronized void decrementReferenceCount() { //KGT > refCount--; //KGT > } //KGT > >diff jcifs_1.1.11\src\jcifs\ntlmssp\Type3Message.java workspace\jcifs\source\jcifs\ntlmssp\Type3Message.java 573,574c573,577 < // NTLMv2 issues w/cross-domain authentication; leave NT empty if >= 3 < if (LM_COMPATIBILITY < 3) setNTResponse(ntResponse); --- > //KGT // NTLMv2 issues w/cross-domain authentication; leave NT empty if >= 3 > //KGT if (LM_COMPATIBILITY < 3) setNTResponse(ntResponse); > // NTLMv2 issues w/cross-domain authentication; leave NT empty if NTLMv2 was sent by the client > // NTLM response will always be 24 bytes; NTLMv2 response will always be longer > if (ntResponse.length == 24) setNTResponse(ntResponse); //KGT |
|
|
Re: JCIFS Pops up dialog box for Authenticating certain users |
