February 2008
October 2007
NTLM HTTP Authentication is insecure by design
This write-up discusses a problem inherent to the situation of a connection-oriented authentication - authorization protocol (e.g. NTLM authentication) used with a proxy server that shares TCP connections among several clients
The NTLM Authentication Protocol
This article seeks to describe NTLM at an intermediate to advanced level of detail, suitable as a reference for implementors.
NTLM - Central Authentication Service - JA-SIG Wiki
SAMBA has a Java JAR that performs the NTLM challenge dialog from a Servlet. It runs as a Servlet Filter in front of an application. If the remote user pass the challenge, the userid is stored in the Request block when the CAS Servlet begins processing
1
(4 marks)
