Problem with Axis2 via proxy with NTLM authentication (currently defaulting to BASIC)

[mahlatse makalancheche]

Hi there

Please forgive me if made any mistake with this post (first timer)

Straight into the issue

We got a wsdl file from a 3rd party, threw it into Eclipse to create the stubs with Axis2-1.4.1, finished writing the client, works great from our office.

Deployed the Webservice client (stubs included) on the Client side, then issues started because The client's WWW connection is done via a proxy (NTLM).

I wrote a normal/direct http connection jsp which after having to upgrade the jdk version, and using the "java.net.Authenticator.setDefault(myAuthenticator)" connects to the WWW just fine. so i started celebrating and all, until i decided to test the Webservice itself.

The code snippet for the jsp:

        Authenticator.setDefault(new MyAuthenticator()); //before calling the openConnection()
        //open HTTP URL connection
	URL conn_url=new URL("http://rtpp.domain.com/ValidateCustomerT");
	HttpURLConnection connection = (HttpURLConnection) conn_url.openConnection();

The code snippet for the Webservice client:

                        TheStub stub = new TheStub ();

                        // NTLM Authentication 
			System.out.println("NTLM Authentication");
			
			List<String> authScheme =new ArrayList<String>();
			authScheme.add(HttpTransportProperties.Authenticator.NTLM); 
			
			HttpTransportProperties.Authenticator ntlmAuthentication = new HttpTransportProperties.Authenticator(); 
			ntlmAuthentication.setAuthSchemes(authScheme);
			ntlmAuthentication.setUsername(System.getProperty("http.proxyUser"));
			ntlmAuthentication.setPassword(System.getProperty("http.proxyPassword"));
			ntlmAuthentication.setHost(System.getProperty("http.proxyHost"));
			ntlmAuthentication.setPort(Integer.parseInt(System.getProperty("http.proxyPort")));
			ntlmAuthentication.setRealm(System.getProperty("http.proxyRealm"));
			
			Options options = stub._getServiceClient().getOptions();
			options.setProperty(HTTPConstants.AUTHENTICATE, ntlmAuthentication); 
			stub._getServiceClient().setOptions(options);

			System.out.println("send Validation");
			
			ValidateCustomerT validateCustomer = new ValidateCustomerT();
			validateCustomer.setCustomerRef(customerRef);
			validateCustomer.setVendorID(vendorID);
			validateCustomer.setTestFlag(true);
			ValidateCustomerTResponse valCustResp = stub.ValidateCustomerT(validateCustomer);                        

And that's where all breaks loose with the following exception:

18:37:10,692 WARN  [HttpMethodDirector] Required credentials not available for [color=red]BASIC [/color]<any realm>@rtpp.domain.com:80
18:37:10,692 WARN  [HttpMethodDirector] Preemptive authentication requested but no default credentials available
18:37:10,698 INFO  [AuthChallengeProcessor] NTLM authentication scheme selected
18:37:10,700 ERROR [HttpMethodDirector] Credentials cannot be used for NTLM authentication: org.apache.commons.httpclient.UsernamePasswordCredentials
org.apache.commons.httpclient.auth.InvalidCredentialsException: Credentials cannot be used for NTLM authentication: org.apache.commons.httpclient.UsernamePasswordCredentials
        at org.apache.commons.httpclient.auth.NTLMScheme.authenticate(NTLMScheme.java:332)
        at org.apache.commons.httpclient.HttpMethodDirector.authenticateProxy(HttpMethodDirector.java:320)
        at org.apache.commons.httpclient.HttpMethodDirector.authenticate(HttpMethodDirector.java:232)
......

After i noticed that the Webservice was always just somehow defaulting to BASIC, did a tcp dump to look at all the differences between the two connections:

Direct (not webservice)

POST http://rtpp.domain.com/ValidateCustomerT HTTP/1.1
Content-Type: application/soap+xml
Date: Fri Jan 28 09:13:56 EAT 2011
User-Agent: Java/1.5.0_22
Host: rtpp.domain.com
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Proxy-Connection: keep-alive
Content-Length: 369
Proxy-authorization: NTLM followed by giberish assumed to be encrypted Credentials

<?xml version='1.0' encoding='UTF-8'?><soapenv:Envelope xmlns:soapenv='http://www.w3.org/2003/05/soap-envelope'><soapenv:Body><ns1:ValidateCustomerT xmlns:ns1='http://rtpp.domain.com/'><ns1:VendorID>VendorIDValue</ns1:VendorID><ns1:CustomerRef>12345678</ns1:CustomerRef><ns1:TestFlag>true</ns1:TestFlag></ns1:ValidateCustomerT></soapenv:Body></soapenv:Envelope>

Via Axis2

POST http://rtpp.domain.com/RTPPWS/RTPPWebService.asmx HTTP/1.0
Content-Type: application/soap+xml; charset=UTF-8; action="http://rtpp.domain.com/ValidateCustomerT"
User-Agent: Axis2
Proxy-Authorization: Basic Og==
Host: rtpp.domain.com
Proxy-Connection: Keep-Alive
Content-Length: 369

<?xml version='1.0' encoding='UTF-8'?><soapenv:Envelope xmlns:soapenv="http://www.w3.org/2003/05/soap-envelope"><soapenv:Body><ns1:ValidateCustomerT xmlns:ns1="http://rtpp.domain.com/"><ns1:VendorID>VendorIDValue</ns1:VendorID><ns1:CustomerRef>12345678</ns1:CustomerRef><ns1:TestFlag>true</ns1:TestFlag></ns1:ValidateCustomerT></soapenv:Body></soapenv:Envelope>

Extra info:
I've seen that the warning

Required credentials not available for BASIC

is given in HttpMethodDirector.java in method authenticateHost(final HttpMethod method)

private void authenticate(final HttpMethod method) {
  230           try {
  231               if (this.conn.isProxied() && !this.conn.isSecure()) {
  232                   authenticateProxy(method);
  233               }
  234               authenticateHost(method);
  235           } catch (AuthenticationException e) {
  236               LOG.error(e.getMessage(), e);
  237           }
  238       }

and that method has the following:

  262           AuthState authstate = method.getHostAuthState();
  263           AuthScheme authscheme = authstate.getAuthScheme();

So the

authscheme

is taken from the

method

which I would guess is "supposed" to be getting these details within HttpMethodDirector.java:

  120       public void executeMethod(final HttpMethod method) throws IOException, HttpException {
  121           if (method == null) {
  122               throw new IllegalArgumentException("Method may not be null");
  123           }
  124           // Link all parameter collections to form the hierarchy:
  125           // Global -> HttpClient -> HostConfiguration -> HttpMethod
  126           this.hostConfiguration.getParams().setDefaults(this.params);
  127           [color=red]method.getParams().setDefaults(this.hostConfiguration.getParams());[/color]
  128           

I have no idea why this thing is still defaulting to BASIC.

What am i doing wrong with the webservice client?

Please help...

Thanks in Advance

[Shankar Tanikella]

Looks like Axis2 has some problems with NTLM incoperated.

try this post http://wso2.org/library/161

[mahlatse makalancheche]

Hi Shankar

Thanks for the response, i'm currently out of ideas on this one (still trying to find a way but also started thinking of an alternative way to Axis for doing the webservice).

But still hoping someone will come with a solution.

Just thought someone out there would have had to do Axis via ntlm proxy before.

Please let me know if you have a light bulb moment

[Kunal Sham]

Hi mahlatse,
Did you find the solution for this problem. I had similar problem but not able to find solution from many days. Also you mentioned that with old version of java and from your office you were able to get authenticated. Can you share that code.
I want to invoke a webservice on sharepoint with NTLM authentication, i don't have aproxy in between. please suggest.

[mahlatse makalancheche]

Hi Kunal

Did you find the solution for this problem

Unfortunately, NO, I ditched the whole Axis idea.
I decided that since a webservice is just an xml over http at the end of the day, to write the xml myself (created a skeleton file),
fill it up using DomParser, messed around with the http request headers to make sure they adhered to the spec,
so i'm doing the whole thing as in jsp example i put in the first post, using Authenticator
and those guys that sit in those financial&projects meetings in their fancy suites stopped pointing fingers at me...
so i guess that means it's working just fine

Also you mentioned that with old version of java and from your office you were able to get authenticated. Can you share that code.
I want to invoke a webservice on sharepoint with NTLM authentication

Slight misunderstanding there, from the office, we were connecting directly to the EndPoint without having to deal with any authentication.
The authentication stuff started on the client side, who uses a proxy for their web connections, and the proxy just happened to be using NTLM,
so we were forced to do the NTLM authentication to get past the proxy.

Ooooh! I just found the link that might have an answer to your specific problem:
https://coderanch.com/t/518873/Web-Services/java/Consume-Sharepoint-Web-Service-inside

That guy seems to also be using NTLM for consuming a sharepoint webservice

Let us know how it goes