-1

According to the result monitored by fiddler, there are totally 3 handshakes for integrated windows authentication for IE.

GET /home

-

401 Unauthorized

WWW-Authenticate: Negotiate, NTLM

GET /home

Authorization: Negotiate UYTYGHGYKHKJPPP-===

-

401 Unauthorized

WWW-Authenticate: Negotiate UYUGKJKJKJ+++766==

Get /home

Authorization: Negotiate HJGKJLJLJ+++===

-

200 OK

WWW-Authenticate: Negotiate UHLKJKJKJJLK===

Who knows what concrete things are done for the three, especially the 2nd one.

P.S. The network environment is work group mode, other than domain mode, and the server is a website hosted on my local PC. In other words, the client (IE) & the server are both in the same machine.

Improve this question
2
  • I believe that at least two attempts will be required because the client and the server are not in the same domain (since they're both in workgroup mode). On the first attempt the client browser uses the security context of the currently logged in user, which the server doesn't recognize. The second attempt should prompt the user for credentials. Is that what you see when accessing the site?
    – joeqwerty
    Nov 8, 2013 at 0:29
  • The web site is hosted in the local host. In other words, the client (IE) & server are both in the same machine.
    – user197658
    Nov 8, 2013 at 0:41

1 Answer 1

Reset to default
3

This is how SPNEGO-based Kerberos and NTLM HTTP authentication works. This is, basically, tunneling the Simple And Protected Negotiate (SPNEGO) and the Generic Security Services Application Program Interface (GSSAPI) protocols over HTTP.

The client attempts to access the resource and receives a 401 with the WWW-Authenticate: Negotiate, NTLM header. The client recognizes that the Negotiate authentication protocol is available and attempts to request the resource again, providing a GSSAPI SPNEGO negotiation message in the Authorization header. The server will respond with another 401 and another `WWW-Authenticate' header. This will continue until the SPNEGO negotiation is complete.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .