Web API

Authentication

Windows Authentication using NTLM

Windows Authentication using NTLM is a challenge-response based authentication protocol that requires multiple requests to complete. Here are the steps involved in the process:

  1. The client initiates the authentication process by sending a request to the API endpoint. This can be done by either:
    • adding the query parameter ?login=windows to the URL
    • or by sending the request with an Authorization: NTLM header
  2. The server responds with a challenge in the form of a NTLM token, which the client must use to compute a response.
  3. The client sends another request to the API endpoint, including the computed response in the request headers.
  4. The server verifies the response and, if correct, grants access to the API.

Note: It's important to keep track of the session cookie by sending it along with each subsequent request to maintain state.

Note: The client-side implementation of NTLM authentication must be handled by either custom code or by using libraries that can manage the authentication process for you.

Note: For NTLM / windows authentication to be used, the plugin has to be enabled and used as System Authentication provider.

# First Request
 
# REQUEST
POST /api HTTP/1.1
Authorization: NTLM TlRMTVNTUAABAAAAB7IIogAAAAAAAAAAAAAAAAAAAAAGAbEdAAAADw==
Content-Type: application/json
 
# RESPONSE with actual challenge
HTTP/1.1 401 Unauthorized
WWW-Authenticate: NTLM TlRMTVNTUAACAAAAAAAAACgAAAABggAAU3J2Tm9uY2UAAAAAAAAAAA==
Content-Length: 0
Date: Mon, 14 Feb 2023 06:48:54 GMT
# Secod Request
 
# REQUEST with NTLN response computed by the client based on the challenge
POST /api HTTP/1.1
Authorization: NTLM TlRMTVNTUAADAAAAGAAYAEgAQABQAQAAYAAAABAAEADgAAAA1TSU1BAAAAD05NTUxNTkxM0UyMg==
Content-Type: application/json
 
# RESPONSE
HTTP/1.1 200 OK
Content-Length: ...
Date: Mon, 14 Feb 2023 06:48:55 GMT