Netty provider not handling NTLM type 2 message

[frankwong15]

The check for NTLM type 2 message is wrong. Auth header would be "NTLM <message>".

Here is the fix
https://gist.github.com/frankwong15/5994611

[slandelle]

Hi,

What's the issue exactly?

[frankwong15]

Hi @slandelle , please refer to the NTLM handshake explained in http://www.innovation.ch/personal/ronald/ntlm.html

for the first message from server, wwwAuth would be NTLM and will handled by ntlmChallenge

  2: C <--  S   401 Unauthorized
  WWW-Authenticate: NTLM

but for the second message from server, wwwAuth would be NTLM <message> and hence will not be handled by ntlmChallenge

 4: C <--  S   401 Unauthorized
 WWW-Authenticate: NTLM <base64-encoded type-2-message>

The correct condition should be wwwAuth.get(0).startsWith("NTLM") instead of wwwAuth.contains("NTLM")

[slandelle]

So using startsWith("NTLM") is more accurate, but it evaluates to true in both cases, just like contains, or am I missing something?

[frankwong15]

No, it is not.

wwwAuth is an array.
In the first case, wwwAuth would be List("NTLM")
In the second case, wwwAuth would be List("NTLM XXYYZZ")

wwwAuth.contains("NTLM") would not match the second case.

[slandelle]

OK, get it!