RE: NTLMHttpFilter for multiple Domains?

[Jose Luis Martinez Avial-2]

Some parts of this message have been removed. Learn more about Nabble's security policy.

Did you get something on this? I'm looking to do the same thing.

 

Regards

JL

---

From: jcifs-bounces+jlmartinez=bpi-gruposantander.com@... [mailto:jcifs-bounces+jlmartinez=bpi-gruposantander.com@...] On Behalf Of AJ Weber
Sent: Wednesday, April 23, 2008 11:44 AM
To: jcifs@...
Subject: [jcifs] NTLMHttpFilter for multiple Domains?

Has anyone extended the NTLMHttpFilter to support multiple "allowed" domains?

 

I may have a situation where multiple domains are allowed for authentication to a site, and they don't have an appropriate Trust Relationship setup.

 

I think I could extend it to support this myself, but didn't want to "reinvent the wheel" if someone else already had done it and can share.

 

Thanks in advance,

AJ

Internet communications are not secure and therefore Banco
Santander International does not accept legal responsibility for
the contents of this message. Any views or opinions presented are
solely those of the author and do not necessarily represent those
of Banco Santander International unless otherwise specifically
stated.

Las comunicaciones via Internet no son seguras y por lo tanto
Banco Santander International no asume responsabilidad legal ni
de ningun otro tipo por el contenido de este mensaje. Cualquier
opinion transmitida pertenece unicamente al autor y no
necesariamente representa la opinion del Banco Santander
International a no ser que este expresamente detallado.

[AJ Weber]

Some parts of this message have been removed. Learn more about Nabble's security policy.

Yes.  I got something working...I'm "beta testing" it right now.

 

I have a "known issue" with the interaction with one of our J2EE webapps that I'm trying to figure-out.  For whatever reason, it seems like the new filter is clobbering some of the existing HTTP Session's context.  I can't see how, and have started to work on debugging it.

 

Otherwise, it successfully authenticates users against any number of configured allowed domains (and correctly rejects incorrect authentication attempts, or attempts against non-configured domains).

 

The other "known limitation" is that if the user's workstation/session is NOT currently logged-into any NT Domain, IE falls-back to prompting the user for credentials.  In this case, the order in which the NTLM Messages go back-and-forth plays a hurdle, and the current code will only authenticate those users against the "default domain" (that which is configured using the standard jcifs... properties in the web.xml for the filter).

 

Also, I have only tested this with IE 6.0, 6.5 and 7.0.  I have not tested Firefox, etc.

 

I was planning on releasing the code back to the JCIFS project once I had figured-out this one problem, but I haven't had a lot of luck getting any response at all from them.

 

-AJ

 

----- Original Message -----

From: jlmartinez@...

To: aweber@... ; jcifs@...

Sent: Tuesday, May 13, 2008 11:12 AM

Subject: RE: [jcifs] NTLMHttpFilter for multiple Domains?

Did you get something on this? I'm looking to do the same thing.

 

Regards

JL

---

From: jcifs-bounces+jlmartinez=bpi-gruposantander.com@... [mailto:jcifs-bounces+jlmartinez=bpi-gruposantander.com@...] On Behalf Of AJ Weber
Sent: Wednesday, April 23, 2008 11:44 AM
To: jcifs@...
Subject: [jcifs] NTLMHttpFilter for multiple Domains?

Has anyone extended the NTLMHttpFilter to support multiple "allowed" domains?

 

I may have a situation where multiple domains are allowed for authentication to a site, and they don't have an appropriate Trust Relationship setup.

 

I think I could extend it to support this myself, but didn't want to "reinvent the wheel" if someone else already had done it and can share.

 

Thanks in advance,

AJ

Internet communications are not secure and therefore Banco
Santander International does not accept legal responsibility for
the contents of this message. Any views or opinions presented are
solely those of the author and do not necessarily represent those
of Banco Santander International unless otherwise specifically
stated.

Las comunicaciones via Internet no son seguras y por lo tanto
Banco Santander International no asume responsabilidad legal ni
de ningun otro tipo por el contenido de este mensaje. Cualquier
opinion transmitida pertenece unicamente al autor y no
necesariamente representa la opinion del Banco Santander
International a no ser que este expresamente detallado.

[Doug_D_Nguyen]

Hi AJ

 

I am also working on using NTLMHttpFilter to authenticate for multiple domains. So am interested in seeing your code if possible.

I didn't know that you can try to get user domain from the type 1 message.

 

Initially, I was having the user set a cookie stating what AD domain they belong to and using the correct domain name/AD DC IP once that is known.

 

However, my customer doesn't like using cookie and afraid that it will confuse the user.

 

Regards,

Doug

Doug
W:703 487 8557
C:703 894 8114

-----jcifs-bounces+doug_d_nguyen=nbc.gov@... wrote: -----

To: "Jose Luis Martinez Avial" <jlmartinez@...>, <jcifs@...>
From: "AJ Weber" <aweber@...>
Sent by: jcifs-bounces+doug_d_nguyen=nbc.gov@...
Date: 05/13/2008 12:43PM
Subject: Re: [jcifs] NTLMHttpFilter for multiple Domains?

Yes.  I got something working...I'm "beta testing" it right now.

I have a "known issue" with the interaction with one of our J2EE webapps that I'm trying to figure-out.  For whatever reason, it seems like the new filter is clobbering some of the existing HTTP Session's context.  I can't see how, and have started to work on debugging it.

Otherwise, it successfully authenticates users against any number of configured allowed domains (and correctly rejects incorrect authentication attempts, or attempts against non-configured domains).

The other "known limitation" is that if the user's workstation/session is NOT currently logged-into any NT Domain, IE falls-back to prompting the user for credentials.  In this case, the order in which the NTLM Messages go back-and-forth plays a hurdle, and the current code will only authenticate those users against the "default domain" (that which is configured using the standard jcifs... properties in the web.xml for the filter).

Also, I have only tested this with IE 6.0, 6.5 and 7.0.  I have not tested Firefox, etc.

I was planning on releasing the code back to the JCIFS project once I had figured-out this one problem, but I haven't had a lot of luck getting any response at all from them.

-AJ

----- Original Message -----

From: jlmartinez@...

To: aweber@...; jcifs@...

Sent: Tuesday, May 13, 2008 11:12 AM

Subject: RE: [jcifs] NTLMHttpFilter for multiple Domains?

Did you get something on this? I'm looking to do the same thing.

Regards

JL

---

From: jcifs-bounces+jlmartinez=bpi-gruposantander.com@...[mailto:jcifs-bounces+jlmartinez=bpi-gruposantander.com@...] On Behalf Of AJ Weber
Sent: Wednesday, April 23, 2008 11:44 AM
To: jcifs@...
Subject: [jcifs] NTLMHttpFilter for multiple Domains?

Has anyone extended the NTLMHttpFilter to support multiple "allowed" domains?

I may have a situation where multiple domains are allowed for authentication to a site, and they don't have an appropriate Trust Relationship setup.

I think I could extend it to support this myself, but didn't want to "reinvent the wheel" if someone else already had done it and can share.

Thanks in advance,

AJ

Internet communications are not secure and therefore Banco
Santander International does not accept legal responsibility for
the contents of this message. Any views or opinions presented are
solely those of the author and do not necessarily represent those
of Banco Santander International unless otherwise specifically
stated.

Las comunicaciones via Internet no son seguras y por lo tanto
Banco Santander International no asume responsabilidad legal ni
de ningun otro tipo por el contenido de este mensaje. Cualquier
opinion transmitida pertenece unicamente al autor y no
necesariamente representa la opinion del Banco Santander
International a no ser que este expresamente detallado.