search

antiduh / nsspi

A C# / .Net interface to the Win32 SSPI authentication API
BSD 2-Clause "Simplified" License
64 stars 34 forks source link

Trouble with NTLM Proxy Authentication #10

Closed eabovsky closed 6 years ago

eabovsky commented 6 years ago

I've been trying to implement this library to perform NTLM Proxy Authentication, and am running into a peculiar issue.

The environment setup is:

  1. Both the client machine and the proxy are on the same domain.
  2. The proxy supports Kerberos, NTLM, and Negotiate.

If negotiate is used and selects Kerberos, everything works fine.

However, if I try to force NTLM as the package, the final token gets rejected by the proxy. When testing the code at other sites where NTLM is the only supported option, the handshake also fails in the same way.

My gut instinct is something is wrong with the credential handle or the crypto functions for generating the 3rd token. When I loaded up a token analysis tool, all of the flags and target information looks identical to other apps' tokens which do seem to work.

eabovsky commented 6 years ago

Figured it out.

The problem was that the same socket connection must stay open for the challenge/response calls.