Hi
We have just upgraded our server software, running a Java application, as
follows:
From:
IIS 4, Tomcat 4.1 - both running on same server - NT4
To:
IIS 5, Tomcat 4.1 - both running on same server - Windows 2000
The application is to be available to all staff, either over the Intranet
or the Internet.
An issue has arisen with NTLM authentication. We extract a users
domain\username details using NTLM Authentication, the code is listed at the
bottom of this e-mail. This mechanism worked 100% on the old configuration.
Unfortunately with the IIS server upgrade and change in OS the
authentication details do not seem to be being picked up in two scenarios.
1. IE 6, unless Enable Integrated Windows Authentication is disabled.
We don't really want Browser settings to affect access.
2. IE 5! (We are trying to force client sites to upgrade to IE6, but
still why does the NTLM Authentication break down here?)
The IIS settings are as follow:
Default Web Site:
Anonymous Access - OFF
Basic Authentication - ON
Integrated Windows Authentication - ON
Jakarta Virtual Directory:
Anonymous Access - ON
Basic Authentication - ON
Integrated Windows Authentication - ON
If anyone has had any similar experiences or knows of any other mechanism to
retrieve domain/username, it would be great to hear.
Thanks
Sue
Code to Extract domain/user Details
****************************************************************************
***********
String auth = request.getHeader("Authorization");
if (auth == null) {
response.setStatus(response.SC_UNAUTHORIZED);
response.setHeader("WWW-Authenticate", "NTLM");
return;
}
String domain = "";
String username = "";
if (auth.startsWith("NTLM ")) {
byte[] msg = new
sun.misc.BASE64Decoder().decodeBuffer(auth.substring(5));
int off = 0, length, offset;
if (msg[8] == 1){
byte z = 0;
byte[] msg1 = {(byte)'N', (byte)'T', (byte)'L',
(byte)'M', (byte)'S', (byte)'S', (byte)'P',
z,(byte)2, z, z, z, z, z, z, z,(byte)40, z, z, z,
(byte)1, (byte)130, z, z,z, (byte)2, (byte)2,
(byte)2, z, z, z, z, z, z, z, z, z, z, z, z};
response.setHeader("WWW-Authenticate", "NTLM " +
new sun.misc.BASE64Encoder().encodeBuffer(msg1));
response.sendError(response.SC_UNAUTHORIZED);
return;
} else if (msg[8] == 3) {
off = 30;
length = msg[off+17]*256 + msg[off+16];
offset = msg[off+19]*256 + msg[off+18];
String remoteHost = new String(msg, offset, length);
length = msg[off+1]*256 + msg[off];
offset = msg[off+3]*256 + msg[off+2];
domain = new String(msg, offset, length);
length = msg[off+9]*256 + msg[off+8];
offset = msg[off+11]*256 + msg[off+10];
username = new String(msg, offset, length);
String employeeNTLogin = domain + "\\" + username;
context.log("User NT Login: "+ employeeNTLogin + ":: " +
new Date(System.currentTimeMillis()));
session.setAttribute (Constants.DATABASE,
context.getAttribute(Constants.DATABASE));
Employee userEmployee=null;
// 1. Get Employee Object for NT Login of User & Roles
try {
userEmployee =
myEmployeeDAO_Pool.getDetailsByNTLogin(employeeNTLogin);
} catch (DAOException daoex){
}
session.setAttribute(Constants.USER_EMPLOYEE,
userEmployee);
etc etc
****************************************************************************
************************
**********************************************************************
***Disclaimer***
The contents of this Email may be privileged and are confidential. If you are
not the intended recipient, any disclosure, copying, distribution or any action
taken or omitted to be taken in reliance on it, is prohibited and may be
unlawful.
Should you wish to use Email as a mode of communication, CMi plc and its
subsidiaries are unable to guarantee the security of Email content outside of
our own computer systems.
This footnote also confirms that this e-mail message has been swept by
Mimesweeper for the presence of computer viruses. Whilst we run anti-virus
software, you are solely responsible for ensuring that any e-mail or
attachment you receive is virus free. We disclaim any liability for any damage
you suffer as a consequence of receiving any virus.
Checkmate International plc (CMi)
Registered in England No 1899857
Registered Office 4th Floor, 35 New Bridge Street, London, EC4V 6BW
Head Office Tele + 44 (0) 1993 885600
Head Office Fax + 44 (0) 1993 885603
Web Site : www.cmi-plc.com
**********************************************************************
