search

SamDecrock / node-http-ntlm

Node.js module to authenticate using HTTP NTLM
MIT License
192 stars 89 forks source link

Type1 message value mismatch/incorrectly produced ? #86

Closed hamzahejja closed 1 year ago

hamzahejja commented 4 years ago

Description:

The functions of this module were used to implement a codebase for NTLM Authentication. Yet though, the values expected for the authentication headers, specifically type1 message was incorrect/mismatched.

NTLM options:

Per the Example provided at bottom of page in NTLM Authentication Scheme for HTTP username: Zaphod password: Beeblebrox hostname (equivalently workstation): LightCity NTdomain (equivalently domain): Ursa-Minor

Expected Behaviour:

Per the Example provided at bottom of page in NTLM Authentication Scheme for HTTP which is included/supplied in the more-information section of the repository's GitHub page, type1 message base64 encoded should be : NTLM TlRMTVNTUAABAAAAA7IAAAoACgApAAAACQAJACAAAABMSUdIVENJVFlVUlNBLU1JTk9S

Actual Behaviour:

The type1 message produced, through passing the above-given workstation NTLM options to the module's createType1Message(options) produces: NTLM TlRMTVNTUAABAAAAB7IIogoACgAxAAAACQAJACgAAAAFASgKAAAAD0xJR0hUQ0lUWVVSU0EtTUlOT1I=

Could there be an issue/bug with the code, or am I missing something here? How come the repo got the NTLM Authentication Scheme for HTTP Example referenced but yet fails to correctly produces its values/outcome?

SamDecrock commented 1 year ago

I did a comparison and it looks like the example from NTLM Authentication Scheme for HTTP:

Here's a comparison:

my module:
4e 54 4c 4d 53 53 50 00   01 00 00 00   07 b2 08 a2   0a 00   0a 00    31 00 00 00           09 00    09 00   28 00 00 00    05 01 28 0a 00 00 00 0f   4c 49 47 48 54 43 49 54 59    55 52 53 41 2d 4d 49 4e 4f 52
"NTLMSSP"                               type1flags    domain  domain   body + workstation    workst   workst  body           version numbers           "LIGHTCITY"                   "URSA-MINOR"
                                                      length  length   length                length   length  length

example on https://www.innovation.ch/personal/ronald/ntlm.html
4e 54 4c 4d 53 53 50 00   01 00 00 00   03 b2 00 00   0a 00   0a 00    29 00 00 00           09 00    09 00   20 00 00 00                              4c 49 47 48 54 43 49 54 59     55 52 53 41 2d 4d 49 4e 4f 52

Don't ask me why this is different.