ansaurus

Question

Java 6 NTLM proxy authentication and HTTPS - has anyone got it to work?

Answer 1

A:

Are you married to JAX-WS? I use Apache Axis2, which uses the commons httpclient and has NTLM authentication built-in.

Example:

//Configure SOAP HTTP client to authenticate to server using NTLM
HttpTransportProperties.Authenticator auth = new HttpTransportProperties.Authenticator();

//TODO make report server credentials configurable
auth.setUsername("jdoe");
auth.setPassword("strongpass");
auth.setDomain("WINDOWSDOMAIN");
auth.setHost("host.mydomain.com");
auth.setPort(443);

Options o = new Options();
o.setProperty(org.apache.axis2.transport.http.HTTPConstants.AUTHENTICATE,auth);
myWebServiceStub._getServiceClient().setOptions(o);

BigZig 2009-08-25 14:34:46

The project is a bit too near release for me to be comfortable with ripping out JAX-WS and replacing it with something, but thanks for the suggestion.

DavidK 2009-08-26 07:37:30

Answer 2

+3 A:

After some debugging, this seems to be a flaw in the JRE class libraries, specifically in sun.net.www.protocol.http.HttpURLConnection.

Studying the HTTP requests and responses in the cases of HTTP and HTTPS endpoints showed that, in the successful HTTP case, the requests had a header Proxy-Connection=keep-alive, which was missing on the failing HTTPS case. Reading more generally, there seems to be some confusion on whether one should use "Proxy-Connection" or just "Connection", too ...

Anyway, it is notable that in the HTTP case, the code goes through HttpURLConnection.writeRequests(), which contains the following code snippet

    /*
     * For HTTP/1.1 the default behavior is to keep connections alive.
     * However, we may be talking to a 1.0 server so we should set
     * keep-alive just in case, except if we have encountered an error
     * or if keep alive is disabled via a system property
     */

    // Try keep-alive only on first attempt
    if (!failedOnce && http.getHttpKeepAliveSet()) {
 if (http.usingProxy) {
     requests.setIfNotSet("Proxy-Connection", "keep-alive");
 } else {
     requests.setIfNotSet("Connection", "keep-alive");
 }

There's no such code when creating a tunnel through the proxy for HTTPS, which causes Squid to get upset during the NTLM authentication conversation.

To work around this, in HttpURLConnection.sendCONNECTRequest(), I added

if (http.getHttpKeepAliveSet()) {
 if (http.usingProxy) {
  requests.setIfNotSet("Proxy-Connection", "keep-alive");
 }
}

just before

setPreemptiveProxyAuthentication(requests);
http.writeRequests(requests, null);

I inject my modified HttpURLConnection.class into the JRE using the "-Xbootclasspath/p" flag, and now it works! Not exactly elegant, but there we are.

DavidK 2009-08-26 14:33:43

I'm having the same problem. I found a JDK bug describing exactly the same problem: http://bugs.sun.com/view_bug.do?bug_id=6206466Strangely, it's marked as duplicate/fixed, although the other bug is quite different.

sereda 2010-01-16 11:11:28

Yes, sometimes I'm not sure whether Sun's bug database makes me want to laugh or cry. Possibly they're too busy worrying if Larry Ellison is going to fire them or not to check whether bugs are really duplicates ...

DavidK 2010-01-21 21:58:21

ansaurus

tags:

views:

answers:

Java 6 NTLM proxy authentication and HTTPS - has anyone got it to work?

related questions