abbr / NodeSSPI

Server-side windows authentication for Node.js
MIT License
157 stars 21 forks source link

offerBasic:false not working #3

Closed jamesmayes closed 10 years ago

jamesmayes commented 10 years ago

Hello,

I have modified the sample project to add offerBasic: false but I am still prompted to enter credentials after which I get the expected authenticated results from the local machine account. Any idea what I might be doing wrong? Must I be participating in a domain for SSPI w/NTLM to work or can I also expect it to work locally on my development machine?

Windows 7 Home Premium, 64bit

E:\dev\sspi>node -v
v0.10.32
E:\dev\sspi>npm list node-sspi
└── node-sspi@0.1.4
E:\dev\sspi>npm list express
└── express@3.4.3
 versions:
  { http_parser: '1.0',
    node: '0.10.32',
    v8: '3.14.5.9',
    ares: '1.9.0-DEV',
    uv: '0.10.28',
    zlib: '1.2.3',
    modules: '11',
    openssl: '1.0.1i' },
 arch: 'x64',
 platform: 'win32',

index.js

'use strict';

var express = require('express');
var app = express();
var server = require('http').createServer(app);
app.configure(function () {
  app.use(function (req, res, next) {
    var nodeSSPI = require('node-sspi');
    var nodeSSPIObj = new nodeSSPI({
      retrieveGroups: true, offerBasic: false
    });
    nodeSSPIObj.authenticate(req, res, function(err){
      res.finished || next();
    });
  });
  app.use(function (req, res, next) {
    var out = 'Hello ' + req.connection.user + '! You belong to following groups:<br/><ul>';
    if (req.connection.userGroups) {
      for (var i in req.connection.userGroups) {
        out += '<li>'+ req.connection.userGroups[i] + '</li><br/>\n';
      }
    }
    out += '</ul>';
    res.send(out);
  });
});
// Start server
var port = process.env.PORT || 3000;
server.listen(port, function () {
  console.log('Express server listening on port %d in %s mode', port, app.get('env'));
});
abbr commented 10 years ago

Just because you are prompted for log in doesn't necessarily mean it's using basic auth under the hood. NTLM can also prompt. To confirm, you have to inspect the request using a tool such as Chrome Web Developer. If you want transparent authentication you need to add the server to local intranet zone. There may be other settings.