.net – How to find if NTLM or Kerberos is used from WWW-Authenticate: Negotiate header

kerberosnegotiatenetntlmwww-authenticate

I am programming a client application in .Net that communicates with server via HTTP.

I need to set different request buffering options in case of NTLM and Kerberos authorization.

How to find out if NTLM or Kerberos is used? Is it possible to somehow decode 'WWW-Authenticate: Negotiate' header?

Best Answer

You will find answer here.

Short answer is:

1.Capture some successfully authorized request using Fiddler tool.
2.Choose "Inspectors" -> "Headers" tab.
3.Pay attention at "Cookies / Login" section, "Authorization" header.

If the Authorization token begins with "YII" then Kerberos is used, but if it begins with "TlR" then Kerberos is not used.

For example Kerberos:

Authorization: Negotiate YIIVDAYGKwYBE...

Not Kerberos:

Authorization: Negotiate TlRMTVNTUA...

Related Solutions

Indicate to clients that SPNEGO is supported but NTLM is not for HTTP requests

Yes you can. Take a look at the reference docs of the SPNEGO HTTP Servlet Filter project.

WCFTestClient The HTTP request is unauthorized with client authentication scheme ‘Anonymous’

I didn't have control over the security configuration for the service I was calling into, but got the same error. I was able to fix my client as follows.

In the config, set up the security mode:

<security mode="TransportCredentialOnly">
  <transport clientCredentialType="Windows" proxyCredentialType="None" realm="" />
  <message clientCredentialType="UserName" algorithmSuite="Default" />
</security>

In the code, set the proxy class to allow impersonation (I added a reference to a service called customer):

Customer_PortClient proxy = new Customer_PortClient();
proxy.ClientCredentials.Windows.AllowedImpersonationLevel =    
         System.Security.Principal.TokenImpersonationLevel.Impersonation;

Best Answer

Related Solutions

Indicate to clients that SPNEGO is supported but NTLM is not for HTTP requests

WCFTestClient The HTTP request is unauthorized with client authentication scheme ‘Anonymous’

Related Topic