search

jborean93 / pyspnego

Python SPNEGO authentication library
MIT License
52 stars 11 forks source link

MSV_AV_TARGET_NAME is unspecified in NTLM authenticate message #76

Closed alonchin closed 9 months ago

alonchin commented 9 months ago

Hey @jborean93

Firstly, thanks for your excellent work on the pyspengo project. It's working well for the past two years with different services. However, I recently encountered an authentication failure issue when the server responded with a 500 status code on the AUTHENTICATE_MESSAGE from my client. Interestingly, NTLM authentication through CURL works seamlessly for the same server and credentials.

Upon analyzing the parsed NTLM token from the authenticate message, I observed a critical discrepancy in the MSV_AV_TARGET_NAME field which doesn't contain the proper value:

{
  "AvId": "MSV_AV_TARGET_NAME (9)",
  "Value": "host/unspecified"
}

In contrast, the same field in CURL's NTLM token contains a meaningful string like "HTTP/dashboard.dev.customer.com". The flags in the AvPairs seem identical except for MSV_AV_SINGLE_HOST and MSV_AV_CHANNEL_BINDINGS, but I don't think it could be the reason for the failure. All the rest MSV_AV_NB_DOMAIN_NAME, MSV_AV_NB_COMPUTER_NAME, MSV_AV_DNS_DOMAIN_NAME, MSV_AV_DNS_COMPUTER_NAME, MSV_AV_DNS_TREE_NAME, MSV_AV_FLAGS are the same.

While examining your library, I noticed that service and hostname are initialized with strings host and unspecified. However, I couldn't find the specific location where other values are assigned to these variables. It probably keeps the default values and they are packed to the final message. Any clarification or guidance on this matter would be greatly appreciated.

Thanks again for your time and the library!

jborean93 commented 9 months ago

It’s up to the caller of pyspnego to specify the host and service to use in the token. The defaults there mean that it’s not being set. Historically this wasn’t ever an issue with NTLM as most services just ignore this value but I’ve seen some hardening policies on Windows which will actually try and verify this value which sounds like what you might be encountering.

Unfortunately there’s not much pyspnego can do here, it just generates the tokens and thus it’s the caller who needs to pass the required information to it.

alonchin commented 9 months ago

It is a good point, I will try to pass the additional parameters to the client. Thanks!

alonchin commented 9 months ago

@jborean93 is there any specification of how the value should look like for MSV_AV_TARGET_NAME? I'm curious why CURL uses HTTP for the service. It is clear what the hostname and I can find it (dashboard.dev.customer.com), but can I just add HTTP or even skip this param at all?

jborean93 commented 9 months ago

It all depends on the target and service you are talking to, for a website typically you use http + the hostname you are connecting to. You can't skip this param as your endpoint seems to be validating it.