erlandranvinge / ntlm.js

Implementation of Microsoft NTLM in javascript. Allows you to do that NTLM ajax you've always wanted.

ntlm.js

Javascript implementation of Microsoft NTLM authentication over HTTP. Gives you the possibility to do that AJAX NTLM you've always wanted.

Usage

Ntlm.setCredentials('domain', 'username', 'password');
var url = 'http://myserver.com/secret.txt';

if (Ntlm.authenticate(url)) {
    var request = new XMLHttpRequest();
    request.open('GET', url, false);
    request.send(null);
    console.log(request.responseText);
    // => My super secret message stored on server.
}

Setup

On the server side, the following CORS HTTP Response headers are required:

• Access-Control-Allow-Headers: Authorization
• Access-Control-Allow-Methods: GET, OPTIONS
• Access-Control-Allow-Origin: *
• Access-Control-Expose-Headers: WWW-Authenticate

Known issues

Since the IIS isn't built (??) to support CORS, it will react in a most unfortunate way when receiving a preflight OPTION request (HTTP 401). The remedy for this is to use your own module or disable security checks in the browser.

References

• http://www.innovation.ch/personal/ronald/ntlm.html
• http://download.microsoft.com/download/a/e/6/ae6e4142-aa58-45c6-8dcf-a657e5900cd3/[MS-NLMP].pdf
• http://download.microsoft.com/download/a/e/6/ae6e4142-aa58-45c6-8dcf-a657e5900cd3/[MS-NTHT].pdf

ntlm.js's Issues

NTLM Version

Which is NTLM version supported?

Async

Hi there! I was wondering if there is a reason why the auth requests are made synchronously rather than async? I am in a situation where I need to make the requests async so wondering if this is deliberate

Is there a way to cache the output of setCredentials() for later use

I am not sure that I understand the NTLM authentication scheme, but it looks like the first "phase" is to issue a semi-encrypted version of the username and password.

I would like to save that to re-use, instead of storing the password or repeatedly prompting the user.

Am I off-base in my understanding?

Subdomains

This works fine for top level domain accounts but I'm having trouble getting it to work with sub domains.

For example, using the credentials Ntlm.setCredentials('TEST.COM', 'JACK', 'JACK') works fine.


However using the credentials Ntlm.setCredentials('SUB.TEST.COM', 'JACK', 'JACK') tells me my credentials are wrong even though I know they are definitely right.


I appreciate any help in advance.

This code doesn't connect to a Exchange Web Services (EWS) application

I'm trying to use this code to authenticate to a EWS server, but unfortunatelly it doesn't work.
The NEGOTIATE message (message1) doesn't get a challenge from the server unless I change the NEGOTIATE flag to 0x00088207.
From my understanding the 0x0008 performs a a NTLMv2 requests.

With these change, the server sends back the CHALLENGE message, but the AUTHENTICATE message the code sends to the server isn't authorized.
The code keeps receiving 401 Unauthorized response.

I see in the spec that the AUTHENTICATE message is different for NTLMv2. This would explain the reason for not get authenticated in the server.

Could you tell me how to be sure if the exchanged messages are v1 or v2?
Do you have any experience with such scenario? NTLM v2?
Do you think your project could be adapted to support NTLM v2 authentication?

Thanks in advance for your help.
Cleiton