Windows login username required at server end

View: New views
10 Messages — Rating Filter:   Alert me  

Windows login username required at server end

by Abhijit Karpe :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message

Some parts of this message have been removed. Learn more about Nabble's security policy.

Hello,

 

I have a requirement wherein I need the windows login username in my application on JBoss.

I have been investigating using the JCIFS library but so far whatever I do, JCIFS tries to authenticate the user with the domain controller.

 

What I need is not authentication with the domain controller. I just need access to the username with which the user has logged in to the windows machine.

My application assumes that if the user has successfully logged in, he is a valid user.

 

Can JCIFS help me with my requirement?

 

If not, does anyone know how I may be able to achieve this? Any help in this regard is highly appreciated.

 

Thanking everyone in advance,

Abhi


Re: Windows login username required at server end

by Yannick-9 :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message

Hi Abhi,

I'm not a specialist, but as far as I understand, JCIFS performs a
domain authentication.

I remember using some native code that did what you are describing.
The advantage of JCIFS is that you are platform independant. As soon as
you introduce native code, you get stuck with the operating system.

Is there any reason why you don't want to do a domain authentication?

Yannick

Abhijit Karpe wrote:

>
> Hello,
>
>  
>
> I have a requirement wherein I need the windows login username in my
> application on JBoss.
>
> I have been investigating using the JCIFS library but so far whatever
> I do, JCIFS tries to authenticate the user with the domain controller.
>
>  
>
> What I need is not authentication with the domain controller. I just
> need access to the username with which the user has logged in to the
> windows machine.
>
> My application assumes that if the user has successfully logged in, he
> is a valid user.
>
>  
>
> Can JCIFS help me with my requirement?
>
>  
>
> If not, does anyone know how I may be able to achieve this? Any help
> in this regard is highly appreciated.
>
>  
>
> Thanking everyone in advance,
>
> Abhi
>


RE: Windows login username required at server end

by Abhijit Karpe :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message

Hello Yannick,

Thanks for your quick response.

In my case domain authentication is immaterial so I would rather avoid
it. For me a user who is successfully logged in to the windows machine
(which is in a secured network) is secure enough to give him access to
my application. It is sort of an SSO support.
Also I need to find the authorization information for the user from my
application database. For this purpose I need the username.

It would be really helpful if anyone could point me to some detailed
documentation on how JCIFS internally works. In that case I would either
be able to extend the behavior to support my requirement or maybe even
write the code that would suffice.

Thanks again for your response!

~
Abhi

-----Original Message-----
From: Yannick Lavanant [mailto:yannick@...]
Sent: Thursday, June 05, 2008 7:14 PM
To: Abhijit Karpe
Cc: jcifs@...
Subject: Re: [jcifs] Windows login username required at server end

Hi Abhi,

I'm not a specialist, but as far as I understand, JCIFS performs a
domain authentication.

I remember using some native code that did what you are describing.
The advantage of JCIFS is that you are platform independant. As soon as
you introduce native code, you get stuck with the operating system.

Is there any reason why you don't want to do a domain authentication?

Yannick

Abhijit Karpe wrote:

>
> Hello,
>
>  
>
> I have a requirement wherein I need the windows login username in my
> application on JBoss.
>
> I have been investigating using the JCIFS library but so far whatever
> I do, JCIFS tries to authenticate the user with the domain controller.
>
>  
>
> What I need is not authentication with the domain controller. I just
> need access to the username with which the user has logged in to the
> windows machine.
>
> My application assumes that if the user has successfully logged in, he

> is a valid user.
>
>  
>
> Can JCIFS help me with my requirement?
>
>  
>
> If not, does anyone know how I may be able to achieve this? Any help
> in this regard is highly appreciated.
>
>  
>
> Thanking everyone in advance,
>
> Abhi
>


Re: Windows login username required at server end

by Yannick-9 :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message

Well, there is a class called jcifs.http.NTLMHttpFilter that you should
be able to extend. You could then override some methods to stop the
authentication. Then of course, change you web.xml to use the new filter
class.

I'm not sure how doable that is, but your best bet is to read the filter
class and see what you can do with it.

There are a lot of message exchange going on between the client and the
server during the authentication. So if you manage to intercept that
process at the right time, you might be able to do what you want.

Regards
Yannick

Abhijit Karpe wrote:

> Hello Yannick,
>
> Thanks for your quick response.
>
> In my case domain authentication is immaterial so I would rather avoid
> it. For me a user who is successfully logged in to the windows machine
> (which is in a secured network) is secure enough to give him access to
> my application. It is sort of an SSO support.
> Also I need to find the authorization information for the user from my
> application database. For this purpose I need the username.
>
> It would be really helpful if anyone could point me to some detailed
> documentation on how JCIFS internally works. In that case I would either
> be able to extend the behavior to support my requirement or maybe even
> write the code that would suffice.
>
> Thanks again for your response!
>
> ~
> Abhi
>
> -----Original Message-----
> From: Yannick Lavanant [mailto:yannick@...]
> Sent: Thursday, June 05, 2008 7:14 PM
> To: Abhijit Karpe
> Cc: jcifs@...
> Subject: Re: [jcifs] Windows login username required at server end
>
> Hi Abhi,
>
> I'm not a specialist, but as far as I understand, JCIFS performs a
> domain authentication.
>
> I remember using some native code that did what you are describing.
> The advantage of JCIFS is that you are platform independant. As soon as
> you introduce native code, you get stuck with the operating system.
>
> Is there any reason why you don't want to do a domain authentication?
>
> Yannick
>
> Abhijit Karpe wrote:
>  
>> Hello,
>>
>>  
>>
>> I have a requirement wherein I need the windows login username in my
>> application on JBoss.
>>
>> I have been investigating using the JCIFS library but so far whatever
>> I do, JCIFS tries to authenticate the user with the domain controller.
>>
>>  
>>
>> What I need is not authentication with the domain controller. I just
>> need access to the username with which the user has logged in to the
>> windows machine.
>>
>> My application assumes that if the user has successfully logged in, he
>>    
>
>  
>> is a valid user.
>>
>>  
>>
>> Can JCIFS help me with my requirement?
>>
>>  
>>
>> If not, does anyone know how I may be able to achieve this? Any help
>> in this regard is highly appreciated.
>>
>>  
>>
>> Thanking everyone in advance,
>>
>> Abhi
>>
>>    
>
>
>  


Re: Windows login username required at server end

by Michael B Allen :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message

Can you get the username from the environment (e.g. using System.getenv())?

On 6/5/08, Abhijit Karpe <abhijitk@...> wrote:

>
>
>
>
> Hello,
>
>
>
> I have a requirement wherein I need the windows login username in my
> application on JBoss.
>
> I have been investigating using the JCIFS library but so far whatever I do,
> JCIFS tries to authenticate the user with the domain controller.
>
>
>
> What I need is not authentication with the domain controller. I just need
> access to the username with which the user has logged in to the windows
> machine.
>
> My application assumes that if the user has successfully logged in, he is a
> valid user.
>
>
>
> Can JCIFS help me with my requirement?
>
>
>
> If not, does anyone know how I may be able to achieve this? Any help in this
> regard is highly appreciated.
>
>
>
> Thanking everyone in advance,
>
> Abhi


--
Michael B Allen
PHP Active Directory SPNEGO SSO
http://www.ioplex.com/

Parent Message unknown Re: Windows login username required at server end

by AJ Weber :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message

Right, if you use the beginning-part of the filter, you'll want to send the browser the 401 with the Authenticate: NTLM (see actual code).  The client/browers should send you back an NTLM "Type 1 Message".

There is a helper-class you can use to read the properties of that message returned from the client.  One is the Domain.  It _should_ be the domain to which the user is currently authenticated.

Again, this isn't highly secure, but given your requirements to NOT re-authenticate the user (which, BTW would be transparent for IE browsers, and just add some security to the mix), it should be what you need.  If you allow the whole filter to continue, it'll do all three messages and attempt to authenticate the user against the PDC or BDC again.  If you cut-out the code after you receive the Type 1 message, you'll be left with access to that message's properties (including the Domain), and you can go on from there how ever your solution requires.

-AJ


 -------------- Original message ----------------------
From: Yannick Lavanant <yannick@...>

> Well, there is a class called jcifs.http.NTLMHttpFilter that you should
> be able to extend. You could then override some methods to stop the
> authentication. Then of course, change you web.xml to use the new filter
> class.
>
> I'm not sure how doable that is, but your best bet is to read the filter
> class and see what you can do with it.
>
> There are a lot of message exchange going on between the client and the
> server during the authentication. So if you manage to intercept that
> process at the right time, you might be able to do what you want.
>
> Regards
> Yannick
>
> Abhijit Karpe wrote:
> > Hello Yannick,
> >
> > Thanks for your quick response.
> >
> > In my case domain authentication is immaterial so I would rather avoid
> > it. For me a user who is successfully logged in to the windows machine
> > (which is in a secured network) is secure enough to give him access to
> > my application. It is sort of an SSO support.
> > Also I need to find the authorization information for the user from my
> > application database. For this purpose I need the username.
> >
> > It would be really helpful if anyone could point me to some detailed
> > documentation on how JCIFS internally works. In that case I would either
> > be able to extend the behavior to support my requirement or maybe even
> > write the code that would suffice.
> >
> > Thanks again for your response!
> >
> > ~
> > Abhi
> >
> > -----Original Message-----
> > From: Yannick Lavanant [mailto:yannick@...]
> > Sent: Thursday, June 05, 2008 7:14 PM
> > To: Abhijit Karpe
> > Cc: jcifs@...
> > Subject: Re: [jcifs] Windows login username required at server end
> >
> > Hi Abhi,
> >
> > I'm not a specialist, but as far as I understand, JCIFS performs a
> > domain authentication.
> >
> > I remember using some native code that did what you are describing.
> > The advantage of JCIFS is that you are platform independant. As soon as
> > you introduce native code, you get stuck with the operating system.
> >
> > Is there any reason why you don't want to do a domain authentication?
> >
> > Yannick
> >
> > Abhijit Karpe wrote:
> >  
> >> Hello,
> >>
> >>  
> >>
> >> I have a requirement wherein I need the windows login username in my
> >> application on JBoss.
> >>
> >> I have been investigating using the JCIFS library but so far whatever
> >> I do, JCIFS tries to authenticate the user with the domain controller.
> >>
> >>  
> >>
> >> What I need is not authentication with the domain controller. I just
> >> need access to the username with which the user has logged in to the
> >> windows machine.
> >>
> >> My application assumes that if the user has successfully logged in, he
> >>    
> >
> >  
> >> is a valid user.
> >>
> >>  
> >>
> >> Can JCIFS help me with my requirement?
> >>
> >>  
> >>
> >> If not, does anyone know how I may be able to achieve this? Any help
> >> in this regard is highly appreciated.
> >>
> >>  
> >>
> >> Thanking everyone in advance,
> >>
> >> Abhi
> >>
> >>    
> >
> >
> >  
>


Parent Message unknown Re: Windows login username required at server end

by AJ Weber :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message

(Re-reading that email...if you need the username -- not the domain that I was going on about -- you'll need to send the Type 2 message back to the client and retrieve the Type 3 message, which contains the Username.  At that point, you can retrieve it from that helper-class and discard the message; don't bother actually then sending it for authentication to the domain controllers.)

Sorry for the confusion,
AJ

 -------------- Original message ----------------------
From: aweber@...

> Right, if you use the beginning-part of the filter, you'll want to send the
> browser the 401 with the Authenticate: NTLM (see actual code).  The
> client/browers should send you back an NTLM "Type 1 Message".
>
> There is a helper-class you can use to read the properties of that message
> returned from the client.  One is the Domain.  It _should_ be the domain to
> which the user is currently authenticated.
>
> Again, this isn't highly secure, but given your requirements to NOT
> re-authenticate the user (which, BTW would be transparent for IE browsers, and
> just add some security to the mix), it should be what you need.  If you allow
> the whole filter to continue, it'll do all three messages and attempt to
> authenticate the user against the PDC or BDC again.  If you cut-out the code
> after you receive the Type 1 message, you'll be left with access to that
> message's properties (including the Domain), and you can go on from there how
> ever your solution requires.
>
> -AJ
>
>
>  -------------- Original message ----------------------
> From: Yannick Lavanant <yannick@...>
> > Well, there is a class called jcifs.http.NTLMHttpFilter that you should
> > be able to extend. You could then override some methods to stop the
> > authentication. Then of course, change you web.xml to use the new filter
> > class.
> >
> > I'm not sure how doable that is, but your best bet is to read the filter
> > class and see what you can do with it.
> >
> > There are a lot of message exchange going on between the client and the
> > server during the authentication. So if you manage to intercept that
> > process at the right time, you might be able to do what you want.
> >
> > Regards
> > Yannick
> >
> > Abhijit Karpe wrote:
> > > Hello Yannick,
> > >
> > > Thanks for your quick response.
> > >
> > > In my case domain authentication is immaterial so I would rather avoid
> > > it. For me a user who is successfully logged in to the windows machine
> > > (which is in a secured network) is secure enough to give him access to
> > > my application. It is sort of an SSO support.
> > > Also I need to find the authorization information for the user from my
> > > application database. For this purpose I need the username.
> > >
> > > It would be really helpful if anyone could point me to some detailed
> > > documentation on how JCIFS internally works. In that case I would either
> > > be able to extend the behavior to support my requirement or maybe even
> > > write the code that would suffice.
> > >
> > > Thanks again for your response!
> > >
> > > ~
> > > Abhi
> > >
> > > -----Original Message-----
> > > From: Yannick Lavanant [mailto:yannick@...]
> > > Sent: Thursday, June 05, 2008 7:14 PM
> > > To: Abhijit Karpe
> > > Cc: jcifs@...
> > > Subject: Re: [jcifs] Windows login username required at server end
> > >
> > > Hi Abhi,
> > >
> > > I'm not a specialist, but as far as I understand, JCIFS performs a
> > > domain authentication.
> > >
> > > I remember using some native code that did what you are describing.
> > > The advantage of JCIFS is that you are platform independant. As soon as
> > > you introduce native code, you get stuck with the operating system.
> > >
> > > Is there any reason why you don't want to do a domain authentication?
> > >
> > > Yannick
> > >
> > > Abhijit Karpe wrote:
> > >  
> > >> Hello,
> > >>
> > >>  
> > >>
> > >> I have a requirement wherein I need the windows login username in my
> > >> application on JBoss.
> > >>
> > >> I have been investigating using the JCIFS library but so far whatever
> > >> I do, JCIFS tries to authenticate the user with the domain controller.
> > >>
> > >>  
> > >>
> > >> What I need is not authentication with the domain controller. I just
> > >> need access to the username with which the user has logged in to the
> > >> windows machine.
> > >>
> > >> My application assumes that if the user has successfully logged in, he
> > >>    
> > >
> > >  
> > >> is a valid user.
> > >>
> > >>  
> > >>
> > >> Can JCIFS help me with my requirement?
> > >>
> > >>  
> > >>
> > >> If not, does anyone know how I may be able to achieve this? Any help
> > >> in this regard is highly appreciated.
> > >>
> > >>  
> > >>
> > >> Thanking everyone in advance,
> > >>
> > >> Abhi
> > >>
> > >>    
> > >
> > >
> > >  
> >
>


RE: Windows login username required at server end

by Abhijit Karpe :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message

Hello AJ,

Thanks a lot for your timely responses.

Since I am a newbie please bear with my questions.

As I understand, there will be 3 Messages transferred during this
process to authenticate the user and I can break the chain wherever I
want so that the authentication does not proceed further. For this I
assume the application will popup a dialog box asking for username and
password.

But since I only need the username from the client machine, I don't want
such a popup box to appear. The username should be silently passed on
from the client machine to server without the user being provided with a
dialogue box.

I tried a sample application using JCIFS and it shows a popup. However I
observed that even when the popup appears, the following line is shown
on the jboss console -

10:09:09,796 ERROR [STDERR] NtlmHttpFilter: MYDOMAIN\abhijitk:
0xC0000022: j
cifs.smb.SmbAuthException: Access is denied.

This essentially means that before even showing the popup, JCIFS was
able to extract the username from client.

Could you please point me to how I can just get hold of this username?

Deeply appreciate your help!

Thanks,
Abhi

-----Original Message-----
From: aweber@... [mailto:aweber@...]
Sent: Friday, June 06, 2008 12:06 AM
To: Yannick Lavanant; Abhijit Karpe
Cc: jcifs@...
Subject: Re: [jcifs] Windows login username required at server end

(Re-reading that email...if you need the username -- not the domain that
I was going on about -- you'll need to send the Type 2 message back to
the client and retrieve the Type 3 message, which contains the Username.
At that point, you can retrieve it from that helper-class and discard
the message; don't bother actually then sending it for authentication to
the domain controllers.)

Sorry for the confusion,
AJ

 -------------- Original message ----------------------
From: aweber@...
> Right, if you use the beginning-part of the filter, you'll want to
send the
> browser the 401 with the Authenticate: NTLM (see actual code).  The
> client/browers should send you back an NTLM "Type 1 Message".
>
> There is a helper-class you can use to read the properties of that
message
> returned from the client.  One is the Domain.  It _should_ be the
domain to
> which the user is currently authenticated.
>
> Again, this isn't highly secure, but given your requirements to NOT
> re-authenticate the user (which, BTW would be transparent for IE
browsers, and
> just add some security to the mix), it should be what you need.  If
you allow
> the whole filter to continue, it'll do all three messages and attempt
to
> authenticate the user against the PDC or BDC again.  If you cut-out
the code
> after you receive the Type 1 message, you'll be left with access to
that
> message's properties (including the Domain), and you can go on from
there how
> ever your solution requires.
>
> -AJ
>
>
>  -------------- Original message ----------------------
> From: Yannick Lavanant <yannick@...>
> > Well, there is a class called jcifs.http.NTLMHttpFilter that you
should
> > be able to extend. You could then override some methods to stop the
> > authentication. Then of course, change you web.xml to use the new
filter
> > class.
> >
> > I'm not sure how doable that is, but your best bet is to read the
filter
> > class and see what you can do with it.
> >
> > There are a lot of message exchange going on between the client and
the
> > server during the authentication. So if you manage to intercept that

> > process at the right time, you might be able to do what you want.
> >
> > Regards
> > Yannick
> >
> > Abhijit Karpe wrote:
> > > Hello Yannick,
> > >
> > > Thanks for your quick response.
> > >
> > > In my case domain authentication is immaterial so I would rather
avoid
> > > it. For me a user who is successfully logged in to the windows
machine
> > > (which is in a secured network) is secure enough to give him
access to
> > > my application. It is sort of an SSO support.
> > > Also I need to find the authorization information for the user
from my
> > > application database. For this purpose I need the username.
> > >
> > > It would be really helpful if anyone could point me to some
detailed
> > > documentation on how JCIFS internally works. In that case I would
either
> > > be able to extend the behavior to support my requirement or maybe
even

> > > write the code that would suffice.
> > >
> > > Thanks again for your response!
> > >
> > > ~
> > > Abhi
> > >
> > > -----Original Message-----
> > > From: Yannick Lavanant [mailto:yannick@...]
> > > Sent: Thursday, June 05, 2008 7:14 PM
> > > To: Abhijit Karpe
> > > Cc: jcifs@...
> > > Subject: Re: [jcifs] Windows login username required at server end
> > >
> > > Hi Abhi,
> > >
> > > I'm not a specialist, but as far as I understand, JCIFS performs a

> > > domain authentication.
> > >
> > > I remember using some native code that did what you are
describing.
> > > The advantage of JCIFS is that you are platform independant. As
soon as
> > > you introduce native code, you get stuck with the operating
system.
> > >
> > > Is there any reason why you don't want to do a domain
authentication?

> > >
> > > Yannick
> > >
> > > Abhijit Karpe wrote:
> > >  
> > >> Hello,
> > >>
> > >>  
> > >>
> > >> I have a requirement wherein I need the windows login username in
my
> > >> application on JBoss.
> > >>
> > >> I have been investigating using the JCIFS library but so far
whatever
> > >> I do, JCIFS tries to authenticate the user with the domain
controller.
> > >>
> > >>  
> > >>
> > >> What I need is not authentication with the domain controller. I
just
> > >> need access to the username with which the user has logged in to
the
> > >> windows machine.
> > >>
> > >> My application assumes that if the user has successfully logged
in, he

> > >>    
> > >
> > >  
> > >> is a valid user.
> > >>
> > >>  
> > >>
> > >> Can JCIFS help me with my requirement?
> > >>
> > >>  
> > >>
> > >> If not, does anyone know how I may be able to achieve this? Any
help

> > >> in this regard is highly appreciated.
> > >>
> > >>  
> > >>
> > >> Thanking everyone in advance,
> > >>
> > >> Abhi
> > >>
> > >>    
> > >
> > >
> > >  
> >
>


Re: Windows login username required at server end

by Yannick-9 :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message

Hi Abhi,

You can avoid the popup box by adding your webserver as a trusted server
in either IE or Firefox.
IE:
Tools/internet options
Security tab
Local Intranet-> Click the Sites button -> the advanced button, type the
address of your server and press Add.

Firefox:
Type about:config in  the address bar (No http:// before this)
And look for network.automatic-ntlm-auth.trusted-uris
Double click on the preference and type the address of your server


I am using jcifs on our intranet, and the users never have to type their
password to login. You can add a security policy to add the webserver in
the correct security zone for IE. For Firefox, you'll need the users to
do it manually.

Regards
Yannick

Abhijit Karpe wrote:

> Hello AJ,
>
> Thanks a lot for your timely responses.
>
> Since I am a newbie please bear with my questions.
>
> As I understand, there will be 3 Messages transferred during this
> process to authenticate the user and I can break the chain wherever I
> want so that the authentication does not proceed further. For this I
> assume the application will popup a dialog box asking for username and
> password.
>
> But since I only need the username from the client machine, I don't want
> such a popup box to appear. The username should be silently passed on
> from the client machine to server without the user being provided with a
> dialogue box.
>
> I tried a sample application using JCIFS and it shows a popup. However I
> observed that even when the popup appears, the following line is shown
> on the jboss console -
>
> 10:09:09,796 ERROR [STDERR] NtlmHttpFilter: MYDOMAIN\abhijitk:
> 0xC0000022: j
> cifs.smb.SmbAuthException: Access is denied.
>
> This essentially means that before even showing the popup, JCIFS was
> able to extract the username from client.
>
> Could you please point me to how I can just get hold of this username?
>
> Deeply appreciate your help!
>
> Thanks,
> Abhi
>
> -----Original Message-----
> From: aweber@... [mailto:aweber@...]
> Sent: Friday, June 06, 2008 12:06 AM
> To: Yannick Lavanant; Abhijit Karpe
> Cc: jcifs@...
> Subject: Re: [jcifs] Windows login username required at server end
>
> (Re-reading that email...if you need the username -- not the domain that
> I was going on about -- you'll need to send the Type 2 message back to
> the client and retrieve the Type 3 message, which contains the Username.
> At that point, you can retrieve it from that helper-class and discard
> the message; don't bother actually then sending it for authentication to
> the domain controllers.)
>
> Sorry for the confusion,
> AJ
>
>  -------------- Original message ----------------------
> From: aweber@...
>  
>> Right, if you use the beginning-part of the filter, you'll want to
>>    
> send the
>  
>> browser the 401 with the Authenticate: NTLM (see actual code).  The
>> client/browers should send you back an NTLM "Type 1 Message".
>>
>> There is a helper-class you can use to read the properties of that
>>    
> message
>  
>> returned from the client.  One is the Domain.  It _should_ be the
>>    
> domain to
>  
>> which the user is currently authenticated.
>>
>> Again, this isn't highly secure, but given your requirements to NOT
>> re-authenticate the user (which, BTW would be transparent for IE
>>    
> browsers, and
>  
>> just add some security to the mix), it should be what you need.  If
>>    
> you allow
>  
>> the whole filter to continue, it'll do all three messages and attempt
>>    
> to
>  
>> authenticate the user against the PDC or BDC again.  If you cut-out
>>    
> the code
>  
>> after you receive the Type 1 message, you'll be left with access to
>>    
> that
>  
>> message's properties (including the Domain), and you can go on from
>>    
> there how
>  
>> ever your solution requires.
>>
>> -AJ
>>
>>
>>  -------------- Original message ----------------------
>> From: Yannick Lavanant <yannick@...>
>>    
>>> Well, there is a class called jcifs.http.NTLMHttpFilter that you
>>>      
> should
>  
>>> be able to extend. You could then override some methods to stop the
>>> authentication. Then of course, change you web.xml to use the new
>>>      
> filter
>  
>>> class.
>>>
>>> I'm not sure how doable that is, but your best bet is to read the
>>>      
> filter
>  
>>> class and see what you can do with it.
>>>
>>> There are a lot of message exchange going on between the client and
>>>      
> the
>  
>>> server during the authentication. So if you manage to intercept that
>>>      
>
>  
>>> process at the right time, you might be able to do what you want.
>>>
>>> Regards
>>> Yannick
>>>
>>> Abhijit Karpe wrote:
>>>      
>>>> Hello Yannick,
>>>>
>>>> Thanks for your quick response.
>>>>
>>>> In my case domain authentication is immaterial so I would rather
>>>>        
> avoid
>  
>>>> it. For me a user who is successfully logged in to the windows
>>>>        
> machine
>  
>>>> (which is in a secured network) is secure enough to give him
>>>>        
> access to
>  
>>>> my application. It is sort of an SSO support.
>>>> Also I need to find the authorization information for the user
>>>>        
> from my
>  
>>>> application database. For this purpose I need the username.
>>>>
>>>> It would be really helpful if anyone could point me to some
>>>>        
> detailed
>  
>>>> documentation on how JCIFS internally works. In that case I would
>>>>        
> either
>  
>>>> be able to extend the behavior to support my requirement or maybe
>>>>        
> even
>  
>>>> write the code that would suffice.
>>>>
>>>> Thanks again for your response!
>>>>
>>>> ~
>>>> Abhi
>>>>
>>>> -----Original Message-----
>>>> From: Yannick Lavanant [mailto:yannick@...]
>>>> Sent: Thursday, June 05, 2008 7:14 PM
>>>> To: Abhijit Karpe
>>>> Cc: jcifs@...
>>>> Subject: Re: [jcifs] Windows login username required at server end
>>>>
>>>> Hi Abhi,
>>>>
>>>> I'm not a specialist, but as far as I understand, JCIFS performs a
>>>>        
>
>  
>>>> domain authentication.
>>>>
>>>> I remember using some native code that did what you are
>>>>        
> describing.
>  
>>>> The advantage of JCIFS is that you are platform independant. As
>>>>        
> soon as
>  
>>>> you introduce native code, you get stuck with the operating
>>>>        
> system.
>  
>>>> Is there any reason why you don't want to do a domain
>>>>        
> authentication?
>  
>>>> Yannick
>>>>
>>>> Abhijit Karpe wrote:
>>>>  
>>>>        
>>>>> Hello,
>>>>>
>>>>>  
>>>>>
>>>>> I have a requirement wherein I need the windows login username in
>>>>>          
> my
>  
>>>>> application on JBoss.
>>>>>
>>>>> I have been investigating using the JCIFS library but so far
>>>>>          
> whatever
>  
>>>>> I do, JCIFS tries to authenticate the user with the domain
>>>>>          
> controller.
>  
>>>>>  
>>>>>
>>>>> What I need is not authentication with the domain controller. I
>>>>>          
> just
>  
>>>>> need access to the username with which the user has logged in to
>>>>>          
> the
>  
>>>>> windows machine.
>>>>>
>>>>> My application assumes that if the user has successfully logged
>>>>>          
> in, he
>  
>>>>>    
>>>>>          
>>>>  
>>>>        
>>>>> is a valid user.
>>>>>
>>>>>  
>>>>>
>>>>> Can JCIFS help me with my requirement?
>>>>>
>>>>>  
>>>>>
>>>>> If not, does anyone know how I may be able to achieve this? Any
>>>>>          
> help
>  
>>>>> in this regard is highly appreciated.
>>>>>
>>>>>  
>>>>>
>>>>> Thanking everyone in advance,
>>>>>
>>>>> Abhi
>>>>>
>>>>>    
>>>>>          
>>>>  
>>>>        
>
>
>  


RE: Windows login username required at server end

by Abhijit Karpe :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message

Hi Yannick,AJ,

Thanks for your help.

I have currently decided to extend the NtlmHttpFilter and achieve my
requirements. Also I may require to use the Trusted Site setting for my
server.

Will let you know how it goes.

Thanks for your response and help!

Regards,
Abhi

-----Original Message-----
From: Yannick Lavanant [mailto:yannick@...]
Sent: Friday, June 06, 2008 4:03 PM
To: Abhijit Karpe
Cc: jcifs@...
Subject: Re: [jcifs] Windows login username required at server end

Hi Abhi,

You can avoid the popup box by adding your webserver as a trusted server

in either IE or Firefox.
IE:
Tools/internet options
Security tab
Local Intranet-> Click the Sites button -> the advanced button, type the

address of your server and press Add.

Firefox:
Type about:config in  the address bar (No http:// before this)
And look for network.automatic-ntlm-auth.trusted-uris
Double click on the preference and type the address of your server


I am using jcifs on our intranet, and the users never have to type their

password to login. You can add a security policy to add the webserver in

the correct security zone for IE. For Firefox, you'll need the users to
do it manually.

Regards
Yannick

Abhijit Karpe wrote:

> Hello AJ,
>
> Thanks a lot for your timely responses.
>
> Since I am a newbie please bear with my questions.
>
> As I understand, there will be 3 Messages transferred during this
> process to authenticate the user and I can break the chain wherever I
> want so that the authentication does not proceed further. For this I
> assume the application will popup a dialog box asking for username and
> password.
>
> But since I only need the username from the client machine, I don't
want
> such a popup box to appear. The username should be silently passed on
> from the client machine to server without the user being provided with
a
> dialogue box.
>
> I tried a sample application using JCIFS and it shows a popup. However
I

> observed that even when the popup appears, the following line is shown
> on the jboss console -
>
> 10:09:09,796 ERROR [STDERR] NtlmHttpFilter: MYDOMAIN\abhijitk:
> 0xC0000022: j
> cifs.smb.SmbAuthException: Access is denied.
>
> This essentially means that before even showing the popup, JCIFS was
> able to extract the username from client.
>
> Could you please point me to how I can just get hold of this username?
>
> Deeply appreciate your help!
>
> Thanks,
> Abhi
>
> -----Original Message-----
> From: aweber@... [mailto:aweber@...]
> Sent: Friday, June 06, 2008 12:06 AM
> To: Yannick Lavanant; Abhijit Karpe
> Cc: jcifs@...
> Subject: Re: [jcifs] Windows login username required at server end
>
> (Re-reading that email...if you need the username -- not the domain
that
> I was going on about -- you'll need to send the Type 2 message back to
> the client and retrieve the Type 3 message, which contains the
Username.
> At that point, you can retrieve it from that helper-class and discard
> the message; don't bother actually then sending it for authentication
to

> the domain controllers.)
>
> Sorry for the confusion,
> AJ
>
>  -------------- Original message ----------------------
> From: aweber@...
>  
>> Right, if you use the beginning-part of the filter, you'll want to
>>    
> send the
>  
>> browser the 401 with the Authenticate: NTLM (see actual code).  The
>> client/browers should send you back an NTLM "Type 1 Message".
>>
>> There is a helper-class you can use to read the properties of that
>>    
> message
>  
>> returned from the client.  One is the Domain.  It _should_ be the
>>    
> domain to
>  
>> which the user is currently authenticated.
>>
>> Again, this isn't highly secure, but given your requirements to NOT
>> re-authenticate the user (which, BTW would be transparent for IE
>>    
> browsers, and
>  
>> just add some security to the mix), it should be what you need.  If
>>    
> you allow
>  
>> the whole filter to continue, it'll do all three messages and attempt
>>    
> to
>  
>> authenticate the user against the PDC or BDC again.  If you cut-out
>>    
> the code
>  
>> after you receive the Type 1 message, you'll be left with access to
>>    
> that
>  
>> message's properties (including the Domain), and you can go on from
>>    
> there how
>  
>> ever your solution requires.
>>
>> -AJ
>>
>>
>>  -------------- Original message ----------------------
>> From: Yannick Lavanant <yannick@...>
>>    
>>> Well, there is a class called jcifs.http.NTLMHttpFilter that you
>>>      
> should
>  
>>> be able to extend. You could then override some methods to stop the
>>> authentication. Then of course, change you web.xml to use the new
>>>      
> filter
>  
>>> class.
>>>
>>> I'm not sure how doable that is, but your best bet is to read the
>>>      
> filter
>  
>>> class and see what you can do with it.
>>>
>>> There are a lot of message exchange going on between the client and
>>>      
> the
>  
>>> server during the authentication. So if you manage to intercept that
>>>      
>
>  
>>> process at the right time, you might be able to do what you want.
>>>
>>> Regards
>>> Yannick
>>>
>>> Abhijit Karpe wrote:
>>>      
>>>> Hello Yannick,
>>>>
>>>> Thanks for your quick response.
>>>>
>>>> In my case domain authentication is immaterial so I would rather
>>>>        
> avoid
>  
>>>> it. For me a user who is successfully logged in to the windows
>>>>        
> machine
>  
>>>> (which is in a secured network) is secure enough to give him
>>>>        
> access to
>  
>>>> my application. It is sort of an SSO support.
>>>> Also I need to find the authorization information for the user
>>>>        
> from my
>  
>>>> application database. For this purpose I need the username.
>>>>
>>>> It would be really helpful if anyone could point me to some
>>>>        
> detailed
>  
>>>> documentation on how JCIFS internally works. In that case I would
>>>>        
> either
>  
>>>> be able to extend the behavior to support my requirement or maybe
>>>>        
> even
>  
>>>> write the code that would suffice.
>>>>
>>>> Thanks again for your response!
>>>>
>>>> ~
>>>> Abhi
>>>>
>>>> -----Original Message-----
>>>> From: Yannick Lavanant [mailto:yannick@...]
>>>> Sent: Thursday, June 05, 2008 7:14 PM
>>>> To: Abhijit Karpe
>>>> Cc: jcifs@...
>>>> Subject: Re: [jcifs] Windows login username required at server end
>>>>
>>>> Hi Abhi,
>>>>
>>>> I'm not a specialist, but as far as I understand, JCIFS performs a
>>>>        
>
>  
>>>> domain authentication.
>>>>
>>>> I remember using some native code that did what you are
>>>>        
> describing.
>  
>>>> The advantage of JCIFS is that you are platform independant. As
>>>>        
> soon as
>  
>>>> you introduce native code, you get stuck with the operating
>>>>        
> system.
>  
>>>> Is there any reason why you don't want to do a domain
>>>>        
> authentication?
>  
>>>> Yannick
>>>>
>>>> Abhijit Karpe wrote:
>>>>  
>>>>        
>>>>> Hello,
>>>>>
>>>>>  
>>>>>
>>>>> I have a requirement wherein I need the windows login username in
>>>>>          
> my
>  
>>>>> application on JBoss.
>>>>>
>>>>> I have been investigating using the JCIFS library but so far
>>>>>          
> whatever
>  
>>>>> I do, JCIFS tries to authenticate the user with the domain
>>>>>          
> controller.
>  
>>>>>  
>>>>>
>>>>> What I need is not authentication with the domain controller. I
>>>>>          
> just
>  
>>>>> need access to the username with which the user has logged in to
>>>>>          
> the
>  
>>>>> windows machine.
>>>>>
>>>>> My application assumes that if the user has successfully logged
>>>>>          
> in, he
>  
>>>>>    
>>>>>          
>>>>  
>>>>        
>>>>> is a valid user.
>>>>>
>>>>>  
>>>>>
>>>>> Can JCIFS help me with my requirement?
>>>>>
>>>>>  
>>>>>
>>>>> If not, does anyone know how I may be able to achieve this? Any
>>>>>          
> help
>  
>>>>> in this regard is highly appreciated.
>>>>>
>>>>>  
>>>>>
>>>>> Thanking everyone in advance,
>>>>>
>>>>> Abhi
>>>>>
>>>>>    
>>>>>          
>>>>  
>>>>        
>
>
>