search

jborean93 / pyspnego

Python SPNEGO authentication library
MIT License
52 stars 11 forks source link

spnego client without domain name in username argument #61

Closed spbFrogPirate closed 1 year ago

spbFrogPirate commented 1 year ago

If on Windows logon under domain user create spnego.client without domain name, it create authenticate_message with domain name, in example it's "W.O.R.K."

client = spnego.client("usertn", "password", protocol="ntlm")

authenticate_message = TlRMTVNTUAADAAAAGAAYAHYAAAAYABgAjgAAAAgACABYAAAADAAMAGAAAAAKAAoAbAAAABAAEACmAAAANYKI4goAYUoAAAAPW4OUot4KTNozXx/Eu5pL1FcATwBSAEsAdQBzAGUAcgB0AG4ATQBFAEwAUwBTAOZ3ylREhelQAAAAAAAAAAAAAAAAAAAAAB66cLYVo1UpKQq9wMwdUb7ItKRjyqIYPuwwNBqVOkjzdhZIyj8bDgE= 

4E 54 4C 4D 53 53 50 00 03 00 00 00 18 00 18 00 76 00 00 00  NTLMSSP.........v...
18 00 18 00 8E 00 00 00 08 00 08 00 58 00 00 00 0C 00 0C 00  ....Ž.......X.......
60 00 00 00 0A 00 0A 00 6C 00 00 00 10 00 10 00 A6 00 00 00  `.......l.......¦...
35 82 88 E2 0A 00 61 4A 00 00 00 0F 5B 83 94 A2 DE 0A 4C DA  5‚ˆâ..aJ....[ƒ”¢Þ.LÚ
33 5F 1F C4 BB 9A 4B D4 57 00 4F 00 52 00 4B 00 75 00 73 00  3_.Ä»šKÔW.O.R.K.u.s.
65 00 72 00 74 00 6E 00 4D 00 45 00 4C 00 53 00 53 00 E6 77  e.r.t.n.M.E.L.S.S.æw
CA 54 44 85 E9 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ÊTD…    # éP..............
00 00 1E BA 70 B6 15 A3 55 29 29 0A BD C0 CC 1D 51 BE C8 B4  ...ºp¶.£U)).½ÀÌ.Q¾È´
A4 63 CA A2 18 3E EC 30 34 1A 95 3A 48 F3 76 16 48 CA 3F 1B  ¤cÊ¢.>ì04.•:Hóv.HÊ?.                 Oç
jborean93 commented 1 year ago

This scenario on Windows just calls the native SSPI C library on Windows with the credentials you've specified. More specifically it's the SEC_WINNT_AUTH_IDENTITY_W. If the domain fields in the NTLM message is set to WORK then it sounds like it's SSPI itself that's appending the information. Is there a problem with your scenario or just a general observation?

spbFrogPirate commented 1 year ago

Not a problem, but there is a difference in how authorization works. For example, in C# and pywin32, domain information is not added, by default, if it is not in the username. And now it is necessary to register the domain.

jborean93 commented 1 year ago

This is ultimately behaviour of SSPI we can't really change anything in there. You can request the client to use the pure Python NTLM provider with spnego.client(..., options=spnego.NegotiateOptions.use_ntlm). This has no hooks into SSPI and can only use the information you provide. The downside is it won't work for any implicit user and is NTLM only.

And now it is necessary to register the domain.

What do you mean by this sorry?

spbFrogPirate commented 1 year ago

What do you mean by this sorry?

Adding to username "domain" for example write spnego.client("domain\\usertn", "password", protocol="ntlm"), it's works Thanks for the help