Cannot perform handshake. Error: NTLM authentication failed

[totomare]

1. Context

• the Cypress test is carried out between cross-domains - the authentication site is in one domain while the application site is in another
• the authentication site uses Windows Authentication (SSO)
• the authentication site uses a SELF_SIGNED_CERT
• both sites are hosted on Linux
• the password contains a special character “! »

2. Settings

• QA testing environment. Ubuntu 20.4

• Cypress: Cypress package version: 13.1.0 Cypress binary version: 13.1.0 Electron version: 21.0.0 Bundled Node version: 16.16.0

• cypress-ntlm-auth plugin 4.1.2

  • .npmrc strict-ssl=false always-auth=false rejectUnauthorized=false

• In the file cypress/support/commands.js (or .ts) add this line import "cypress-ntlm-auth/dist/commands";

3. The login test

• in the qa-tests module we add

Given ("Test login", ()=> {

 cy.ntlm(["site-autentification.dev.com"], "username","password!");
 cy.visit('https://site-application.dev. com');

})

4. Launch Cypress in DEBUG mode

• In a terminal Ubunbu launch $ export DEBUG_NTLM_HEADERS=1 $ export NODE_TLS_REJECT_UNAUTHORIZED=0 $ DEBUG=cypress:plugin:ntlm-auth npx ntlm-proxy { configApiUrl: 'http://127.0.0.1:33333, ntlmProxyUrl: 'http://127.0.0.1:88888 }

The /.http-mitm-proxy directory is created ~/qa-tests/.http-mitm-proxy/

• In another terminal run $ export CYPRESS_NTLM_AUTH_API=http://127.0.0.1:33333 $ export CYPRESS_NTLM_AUTH_PROXY=http://127.0.0.1:88888 $ export NODE_TLS_REJECT_UNAUTHORIZED=0 $ export DEBUG_NTLM_HEADERS=1 $ npx cypress-ntlm open

5. Message

• Warning cypress:plugin:ntlm-auth Created agent for client 127.0.0.1:33168 to target https:// site-autentification.dev.com/ +1ms cypress:plugin:ntlm-auth Request to https:// site-autentification.dev.com/ in registered NTLM Hosts +0ms (node:23527) Warning: Setting the NODE_TLS_REJECT_UNAUTHORIZED environment variable to '0' makes TLS connections and HTTPS requests insecure by disabling certificate verification. (Usenode --trace-warnings ...to show where the warning was created)

• Error cypress:plugin:ntlm-auth Sending NTLM message type 1 +1ms cypress:plugin:ntlm-auth [NTLM TlRMTVNTUAABAAAAAqAIAgAAAAAoAAAADAAMACgAAAAKALpHAAAAD0RFVkVMT1BFUi1MTQ==] +1ms cypress:plugin:ntlm-auth Cannot perform handshake. Error: NTLM authentication failed (www-authenticate with NTLM not found in server response) with host https://site-autentification.dev.com / at ClientRequest.<anonymous> (/home/developer/qa-tests/node_modules/cypress-ntlm-auth/dist/proxy/ntlm.manager.js:72:33) at Object.onceWrapper (node:events:628:26) at ClientRequest.emit (node:events:513:28) at HTTPParser.parserOnIncomingClient [as onIncoming] (node:_http_client:693:27) at HTTPParser.parserOnHeadersComplete (node:_http_common:128:17) at TLSSocket.socketOnData (node:_http_client:534:22) at TLSSocket.emit (node:events:513:28) at addChunk (node:internal/streams/readable:315:12) at readableAddChunk (node:internal/streams/readable:289:9) at TLSSocket.Readable.push (node:internal/streams/readable:228:10) at TLSWrap.onStreamRead (node:internal/stream_base_commons:190:23) +152ms

The authentication step prevents me from adopting Cypress as a testing framework Please help.

[bjowes]

Hi @totomare

First, thanks for the complete description of the issue from the start. This saves me a lot of effort!

The issue itself is quite weird. Since the plugin is starting a handshake, it has received a 401 response from the https://site-autentification.dev.comsite which indicates in the response headers that NTLM is supported. But then it fails the handshake directly. I have not seen this behaviour before. Usually the whole handshake is performed (type 1 msg from plugin -> server, type 2 msg from server -> plugin, type 3 msg from plugin -> server), and then the response indicates if the login succeeded or not. I also looked at the content of the type 1 msg and it looks fine. To me it seems that the server is not following the NTLM protocol properly.

You state that both sites are run on linux. What is the platform of the software - is it NET 6 or something else?

When you run the test with plain cypress, what is the error? Should be a 401, please confirm it is for site-autentification.dev.com. Just asking since sometimes you need to include additional servers in the cy.ntlm list.

Some other hints (that won't solve the issue):

• You can do export CYPRESS_NTLM_AUTH_API=http://127.0.0.1:33333/ in the first terminal too, that way you control the ports of ntlm-proxy from the start. Also, I assume you aren't really using port 88888, since that would not work. Should be less than 65535 (16 bits).
• You are passing environment variables to skip SSL validation. This is not required (it used to be with older versions of the plugin). You will see warnings though, but the tests will still run. This applies to the npm config also, which may have been needed to install the plugin from npm, but is not required to run the tests.

[totomare]

Hello @bjowes

Thanks for responding quickly.

Our company uses Computer Associates (CA) SiteMinder for authentication management. SiteMinder uses cookies to perform validation. If you need some details about Siteminder you can check this link : About CA SiteMinder (Sun OpenSSO Enterprise 8.0 Integration Guide) (oracle.com)

So it is necessary to assign the cookie content to the request header. The plugin currently does not do this. To test our theory, we modified the file ntlm.manager.js directly in node_modules directory.

 requestOptions.headers["authorization"] = type1header;
 requestOptions.headers["cookie"] = ctx.proxyToServerRequestOptions.headers.cookie;
 requestOptions.headers["connection"] = "keep-alive";

It corresponds to line 81 in github repository. https://github.com/bjowes/cypress-ntlm-auth/blob/master/src/proxy/ntlm.manager.ts#L81C5-L81C5

With this change the test passed successfully.

Can you please add an additional parameter to plugin configuration so plugin include cookies in authentication request once its set to true. To minimize impact on users that does not need to pass cookies when performing NTLM authentication.

Since SiteMinder is widely used in the market it will be profitable to make this addition to the plugin. We want to use the official version of the plugin to benefit from subsequent improvements.

Thanks for the feedback Credits for solution: development team.

PM: if you need additional information’s or clarifications feel free to contact me back.

[bjowes]

Thanks for investigating and suggesting a fix! I think passing along cookies is a sensible thing to do for all users. Implemented in v4.1.3