WinRM(WsMan) 和 NTLM 身份验证

Question

我正在尝试在WsMan连接期间使用NTLM身份验证。但是WinRm不直接支持NTLM方案的问题。 以下是响应标头：

21:57:33.557 [main] DEBUG org.apache.http.wire - http-outgoing-0 << "HTTP/1.1 401 [r][n]"
21:57:33.557 [main] DEBUG org.apache.http.wire - http-outgoing-0 << "Server: Microsoft-HTTPAPI/2.0[r][n]"
21:57:33.557 [main] DEBUG org.apache.http.wire - http-outgoing-0 << "WWW-Authenticate: Negotiate[r][n]"
21:57:33.557 [main] DEBUG org.apache.http.wire - http-outgoing-0 << "WWW-Authenticate: Kerberos[r][n]"
21:57:33.557 [main] DEBUG org.apache.http.wire - http-outgoing-0 << "WWW-Authenticate: CredSSP[r][n]"
21:57:33.557 [main] DEBUG org.apache.http.wire - http-outgoing-0 << "Date: Thu, 10 Aug 2017 18:57:33 GMT[r][n]"
21:57:33.557 [main] DEBUG org.apache.http.wire - http-outgoing-0 << "Connection: close[r][n]"
21:57:33.557 [main] DEBUG org.apache.http.wire - http-outgoing-0 << "Content-Length: 0[r][n]"

官方文档中未提及 NTLM 方案 https://learn.microsoft.com/en-us/powershell/module/Microsoft.WsMan.Management/Get-WSManInstance?view=powershell-5.1

但它说

谈判。协商是一种协商的质询-响应方案 与服务器或代理一起确定要使用的方案 认证。例如，此参数值允许 协商以确定 Kerberos 协议或 NTLM 是否 使用。

我正在尝试使用 SPNEGO 架构

RegistryBuilder<AuthSchemeProvider> builder = RegistryBuilder.<AuthSchemeProvider>create().register(AuthSchemes.SPNEGO, new SPNegoSchemeFactory());

但最后，它失败了 https://pastebin.com/gGNEHGpx 所以看起来NTLM是SPNEGO的子机制，但是如何在Apache http-client中正确使用它呢？

Answer 1

协商意味着 Kerberos 或 NTLM。 https://blogs.technet.microsoft.com/tristank/2006/08/02/two-easy-ways-to-pick-kerberos-from-ntlm-in-an-http-capture/

Answer 2

我找到了一个与WinRm正常工作的SpNegoNTLMSchemeFactory。 https://gist.github.com/moberwasserlechner/4690931

JCIFSEngine.java == apache NTLMEngineImpl.java SpNegoNTLMSchemeFactory.java == apache NTLMSchemeFactory.java

SpNegoNTLMScheme.java ！= apache NTLMScheme.java 但这里唯一的区别是

@Override
public String getSchemeName() {
return AuthSchemes.SPNEGO; //<- apache class return NTLM here
}

@Override
public Header authenticate(final Credentials credentials, final HttpRequest request) throws AuthenticationException {
...
buffer.append(": ");
buffer.append(getSchemeName().toUpperCase());  //<- apache class return NTLM here
buffer.append(" ");
buffer.append(response);
return new BufferedHeader(buffer);
}