Newsgroups : Borland : borland.public.delphi.internet.winsock : 2006 Dec : Re: Indy and NTLM

www.cryer.info
Managed Newsgroup Archive

Re: Indy and NTLM

Subject:Re: Indy and NTLM
Posted by:markus.alexand..@gmx.at
Date:19 Dec 2006 04:46:49

Hello,

> TIdHTTP does not disconnect between multiple steps of an authentication.
> The steps are performed inside of a loop.  A disconnect only occurs between
> actual requests, and even then only if the client does not specify a
> keep-alive (or the server rejects the keep-alive).
>

Well I'm not quite sure about this, so I have attached the network
frames of a request from Indy and one from IE:

Indy:
No.     Time        Source                Destination
Protocol Info
      4 0.000846    192.168.1.73          192.168.1.20          HTTP
GET / HTTP/1.1
      5 0.001631    192.168.1.20          192.168.1.73          TCP
[TCP segment of a reassembled PDU]
      6 0.001664    192.168.1.20          192.168.1.73          HTTP
HTTP/1.1 401 Unauthorized (text/html)
      7 0.001689    192.168.1.73          192.168.1.20          TCP
1067 > http [ACK] Seq=158 Ack=1873 Win=64512 Len=0
      8 0.013952    192.168.1.73          192.168.1.20          TCP
1067 > http [FIN, ACK] Seq=158 Ack=1873 Win=64512 Len=0
      9 0.014244    192.168.1.20          192.168.1.73          TCP
http > 1067 [ACK] Seq=1873 Ack=159 Win=65378 Len=0
     10 0.014292    192.168.1.20          192.168.1.73          TCP
http > 1067 [FIN, ACK] Seq=1873 Ack=159 Win=65378 Len=0
     11 0.014314    192.168.1.73          192.168.1.20          TCP
1067 > http [ACK] Seq=159 Ack=1874 Win=64512 Len=0
     12 0.015192    192.168.1.73          192.168.1.20          TCP
1068 > http [SYN] Seq=0 Len=0 MSS=1460
     13 0.015359    192.168.1.20          192.168.1.73          TCP
http > 1068 [SYN, ACK] Seq=0 Ack=1 Win=16384 Len=0 MSS=1460
     14 0.015398    192.168.1.73          192.168.1.20          TCP
1068 > http [ACK] Seq=1 Ack=1 Win=64512 Len=0
     15 0.016380    192.168.1.73          192.168.1.20          HTTP
GET / HTTP/1.1, NTLMSSP_NEGOTIATE
     16 0.017057    192.168.1.20          192.168.1.73          TCP
[TCP segment of a reassembled PDU]
     17 0.017104    192.168.1.20          192.168.1.73          HTTP
HTTP/1.1 401 Unauthorized, NTLMSSP_CHALLENGE (text/html)
     18 0.017130    192.168.1.73          192.168.1.20          TCP
1068 > http [ACK] Seq=236 Ack=2136 Win=64512 Len=0
     19 0.018678    192.168.1.73          192.168.1.20          TCP
1068 > http [FIN, ACK] Seq=236 Ack=2136 Win=64512 Len=0
     20 0.018876    192.168.1.20          192.168.1.73          TCP
http > 1068 [ACK] Seq=2136 Ack=237 Win=65300 Len=0
     21 0.018917    192.168.1.20          192.168.1.73          TCP
http > 1068 [FIN, ACK] Seq=2136 Ack=237 Win=65300 Len=0
     22 0.018937    192.168.1.73          192.168.1.20          TCP
1068 > http [ACK] Seq=237 Ack=2137 Win=64512 Len=0
     23 0.019872    192.168.1.73          192.168.1.20          TCP
1069 > http [SYN] Seq=0 Len=0 MSS=1460
     24 0.020039    192.168.1.20          192.168.1.73          TCP
http > 1069 [SYN, ACK] Seq=0 Ack=1 Win=16384 Len=0 MSS=1460
     25 0.020074    192.168.1.73          192.168.1.20          TCP
1069 > http [ACK] Seq=1 Ack=1 Win=64512 Len=0
     26 0.021376    192.168.1.73          192.168.1.20          HTTP
GET / HTTP/1.1, NTLMSSP_AUTH, User: v\a
     27 0.022014    192.168.1.20          192.168.1.73          TCP
[TCP segment of a reassembled PDU]
     28 0.022044    192.168.1.20          192.168.1.73          HTTP
HTTP/1.1 401 Unauthorized (text/html)
     29 0.022068    192.168.1.73          192.168.1.20          TCP
1069 > http [ACK] Seq=396 Ack=1756 Win=64512 Len=0


And now the same request using IE:

No.     Time        Source                Destination
Protocol Info
     11 5.377165    192.168.1.73          192.168.1.20          HTTP
GET / HTTP/1.1
     12 5.377976    192.168.1.20          192.168.1.73          TCP
[TCP segment of a reassembled PDU]
     13 5.378121    192.168.1.20          192.168.1.73          HTTP
HTTP/1.1 401 Unauthorized (text/html)
     14 5.378149    192.168.1.73          192.168.1.20          TCP
1086 > http [ACK] Seq=425 Ack=1873 Win=64512 Len=0
     16 14.599746   192.168.1.73          192.168.1.20          HTTP
GET / HTTP/1.1, NTLMSSP_NEGOTIATE
     17 14.601158   192.168.1.20          192.168.1.73          TCP
[TCP segment of a reassembled PDU]
     18 14.601196   192.168.1.20          192.168.1.73          HTTP
HTTP/1.1 401 Unauthorized, NTLMSSP_CHALLENGE (text/html)
     19 14.601224   192.168.1.73          192.168.1.20          TCP
1086 > http [ACK] Seq=932 Ack=4013 Win=64512 Len=0
     20 14.601993   192.168.1.73          192.168.1.20          HTTP
GET / HTTP/1.1, NTLMSSP_AUTH, User: beka-consulting\markus
     21 14.714548   192.168.1.20          192.168.1.73          TCP
[TCP segment of a reassembled PDU]
     52 38.076791   192.168.1.20          192.168.1.73          HTTP
HTTP/1.1 302 Found (text/html)


As you can see, the Packet Flow between Indy and IE is different.

Am I missing something?
Or do you have a working example, you could send to me?

>
> Gambit

TIA
MArkus Alexander

Replies:

In response to:

www.cryer.info
Managed Newsgroup Archive