Authentication filter for handling Negotiate/NTLM negotiation. Used in ProxyAuth.
SSPINegotiateAuth depends on 'win32/sspi' module.
Authentication scheme.
Creates new SSPINegotiateAuth filter.
# File lib/httpclient/auth.rb, line 582 def initialize @challenge = {} @scheme = "Negotiate" end
Challenge handler: remember URL and challenge token for response.
# File lib/httpclient/auth.rb, line 639 def challenge(uri, param_str) return false unless SSPIEnabled || GSSAPIEnabled if param_str.nil? or @challenge[uri].nil? c = @challenge[uri] = {} c[:state] = :init c[:authenticator] = nil c[:authphrase] = "" else c = @challenge[uri] c[:state] = :response c[:authphrase] = param_str end true end
Response handler: returns credential. See win32/sspi for negotiation state transition.
# File lib/httpclient/auth.rb, line 607 def get(req) return nil unless SSPIEnabled || GSSAPIEnabled target_uri = req.header.request_uri domain_uri, param = @challenge.find { |uri, v| Util.uri_part_of(target_uri, uri) } return nil unless param state = param[:state] authenticator = param[:authenticator] authphrase = param[:authphrase] case state when :init if SSPIEnabled authenticator = param[:authenticator] = Win32::SSPI::NegotiateAuth.new return authenticator.get_initial_token(@scheme) else # use GSSAPI authenticator = param[:authenticator] = GSSAPI::Simple.new(domain_uri.host, 'HTTP') # Base64 encode the context token return [authenticator.init_context].pack('m').gsub(%r\n/,'') end when :response @challenge.delete(domain_uri) if SSPIEnabled return authenticator.complete_authentication(authphrase) else # use GSSAPI return authenticator.init_context(authphrase.unpack('m').pop) end end nil end
Resets challenge state. Do not send '*Authorization' header until the server sends '*Authentication' again.
# File lib/httpclient/auth.rb, line 589 def reset_challenge @challenge.clear end
Set authentication credential. NOT SUPPORTED: username and necessary data is retrieved by win32/sspi. See win32/sspi for more details.
# File lib/httpclient/auth.rb, line 596 def set(*args) # not supported end
have we marked this as set - ie that it's valid to use in this context?
# File lib/httpclient/auth.rb, line 601 def set? SSPIEnabled || GSSAPIEnabled end