views:

248

answers:

1

After asking this question, I've been trying to use NegotiateStream to authenticate a Windows client against a Java server. It seems that Java doesn't have great NTLM library support, so I've been working on the assumption that I'd have to use Kerberos, which Java seems to support much better (via the GSS-API).

The problem is that NegotiateStream seems to be attempting to use NTLM every time. The documentation suggests that it could use either, but doesn't specify how it chooses. I can't see any options in the API to control which mechanism it chooses. Is there a way?

I've got myself a Service Principal Name and my client code looks like this:

string spn = "<service-name>/<my-pc-name>"
TcpClient client = new TcpClient(server, port);
NetworkStream stream = client.GetStream();
NegotiateStream neg = new NegotiateStream(stream, true);
neg.AuthenticateAsClient(CredentialCache.DefaultNetworkCredentials, spn);

On the server end, the first set of bytes received are 22,1,0,0,59 and then "NTLMSSP" - which I wasn't expecting.

I've tried a few different formats for the SPN string, not sure what the correct format is there. I originally created the SPN with

setspn -A <service-name>/<my-pc-name>.<domain-name> <my-user-name>

setspn -L lists it successfully as:

TEST/<my-pc-name>.<domain-name>

Am I doing something wrong, or completely misunderstanding this stuff? :)

+2  A: 

The full syntax for an SPN name is <service>/<user>@DOMAIN; apparently, it is possible to omit the domain name. However, if the username is my-pc-name.domain-name, then you shouldn't shorten it further - provide the SPN exactly as spn -L lists it to you.

Martin v. Löwis
Ha, thanks - that works (only if I use the domain name). So concretely, the string that works looks like this:TEST/<my-pc-name>.<domain-name>@<domain-name>I didn't think to try this combination as it looks so redundant, but I guess it makes sense. It doesn't work without the @DOMAIN and the username seems to require the domain name within it too.I'll update the question tomorrow morning to mention the SPN stuff. Am I right in thinking then that NegotiateStream only uses Kerberos if a valid SPN is given, and just quietly falls back to NTLM if not?Thanks for all your help :)
Luke Halliwell
My guess is that it tries to acquire a ticket for the service from the KDC. If the KDC doesn't know the SPN, it won't issue a ticket, and then it falls back to NTLM (which doesn't actually need the "server name").
Martin v. Löwis