search

Azure / go-ntlmssp

NTLM/Negotiate authentication over HTTP
MIT License
189 stars 67 forks source link

Local account - HTTP 401 #16

Open 0x4c6565 opened 6 years ago

0x4c6565 commented 6 years ago

When attempting to authenticate using a local user against a domain-joined machine, a HTTP 401 response is returned. Setting the domain appears to have no affect (.\myuser , TEST\myuser etc.)

0x4c6565 commented 6 years ago

I believe this has something to do with the target (domain) in the authenticate message being set from the challenge message:

https://github.com/Azure/go-ntlmssp/blob/4b934ac9dad38d389d34f0b98d98b2467c422012/authenticate_message.go#L117

https://github.com/Azure/go-ntlmssp/blob/4b934ac9dad38d389d34f0b98d98b2467c422012/authenticate_message.go#L68

gosp commented 4 years ago

I also encounter 401 error when using go-ntlmssp. I use https://github.com/vadimi/go-http-ntlm, it works. So I guess NTLMv2 implementation of go-ntlmssp is different from https://github.com/ThomsonReutersEikon/go-ntlm (which is used by https://github.com/vadimi/go-http-ntlm)

Catbuttes commented 3 years ago

I am reasonably sure this is because the workstation that is being provided in the authenticate message is not one that the local account has permission to log into. vadimi/go-http-ntlm does not set this value, but this library sets it to "go-ntlmssp". I was seeing this issue with accounts that only had access to log into certain machines - even when running on those machines. By providing a blank workstation name int authenticate_message.go I was able to log in successfully.