Passing username/password to webservice using from Teiid

[sanjay_chaturvedi]

Hi,

We are going to introduce a new webservice as a source in our application. Web service is secure REST service.

We have created a -ds.xml having

<config-property type="java.lang.String" name="EndPoint"><SERVICE URL></config-property>

But I am getting Error: Server returned HTTP response code: 401 for URL:

Web service needs window NT credentials , else it is not accessible from browser also.

I tried giving:

<user-name>user</user-name>

<password>password</password> in -ds.xml bt didnt wrk.

Please suggest..urgently.

Thanks.

[rareddy]

I know you said NT credentials, but kind of authentication? Is it kerberos, OAuth, SAML etc?

[sanjay_chaturvedi]

Thanks for picking this Ramesh.

It is an internal SharePoint webservice where they have granted us the access..it must be one out of kerberos or OAuth. We have credentials to enter when hitting that service in browser to get the result.

I can see Authentication header in request with some random value but no SSO token in request or header.

Is it providing some hint ?

[rareddy]

Not really. What does the "Authentication" header say when you put in the password and send the login request just before the random number?

[sanjay_chaturvedi]

Confirmed..header say NTLM,

I asked and got to know that it is actually NTLM authentication window integrated.

https://msdn.microsoft.com/en-us/library/windows/desktop/aa378749%28v=vs.85%29.aspx

[rareddy]

Ok, there are multiple hurdles in this.

• JBoss EAP 6.x does not support NTLM, nor Teiid provides any NTLM support.
• JBoss does support SPNEGO, that can be used for kerberos, and Teiid supports participating in kerberos. For negotiation you can see [1]

Also, how are you logging into Teiid? Just user, password? The flow is client (that logged into domain controller) makes connection to Teiid server, Teiid server in turn need to delegate this userid, password in specific protocol manner to underlying service.

1. Teiid JDBC driver does not support NTLM, that means you can not automatically pass the user/password from your client application. Solution here is to manually passing in the userid, password
2. In the JBoss EAP, you would need to write LoginModule that understands NTLM protocol, and can talk to the domain controller based on the logged in user's userid, password
3. Then you need to extend the "ws" translator, so that it can insert the Authorization header into the request.

3 is easy, 2 is one needs work. You can use libraries like [2] or [3] to implement the solution. If you get solution working, I can consider accepting as contribution. ( I guess you guys owe atleast that much )

The alternative is to see if your company want to expose service with kerboeros authentication instead of NTLM as Kerberos is preferred over NTLM anyway.

[1] Negotiation User Guide

[2] http://jcifs.samba.org/

[3] ntlm-java - NTLM implementation for java - Google Project Hosting

[rareddy]

[TEIID-3035] Request to add NTLM Security to Web service datasources - JBoss Issue Tracker

[rareddy]

Sanjay,

Looking at [1] it indicates that Java 6 has built-in support NTLM. There is simple example here [2]. Another useful tip I found at [3] is

"On Microsoft Windows platforms, NTLM authentication attempts to acquire the user credentials from the system without prompting the user's authenticator object. If these credentials are not accepted by the server then the user's authenticator will be called."

But above may be only true for HTTP invocations. [4] shows a sample for LoginModule, similar to that needs to be written for JBoss.

[1] Apache CXF -- Client HTTP Transport (including SSL support)

[2] http://www.muneebahmad.com/index.php/archives/127

[3] Http Authentication

[4] JaasLounge Project -

[sanjay_chaturvedi]

Thanks for reply Ramesh.

I tried that service from browser and found that it passes header "Authorization" with value "NTLM <token>".

So I thought to attach this header value before making request in ws translator. Now here is two issue:

1. How to generate this NTLM token: I was looking at NTLM Authentication: Java Client Code | Java | MuneebAhmad.com and found that it is passing Authorization header with value "NTLM <token>". I found this token when I ran this program in debug mode and watch "conn" object when it start reading response.

I noticed:

This token is there inside conn object, under "requests (HttpUrlConnection): MessageHeader". When I try conn.getHeaderFields it is giving me response headers not

requests' one. Thu sI am not able to get this string i.e. value of "Authorization" header.

2. Adding this token as Authorization header before calling dispatch.invoke(ds); in subclass of BinaryWSProcedureExecution in case of custom wstranslator.

I tried this:

Map<String, List<String>> httpHeaders = (Map<String, List<String>>)dispatch.getRequestContext().get(MessageContext.HTTP_REQUEST_HEADERS);

   httpHeaders.put("Authorization", Arrays.asList(new String[]{"NTLM <token>"}));

    dispatch.getRequestContext().put(MessageContext.HTTP_REQUEST_HEADERS, httpHeaders);

     dispatch.invoke(ds)

But here I have to have token atleaset to pass or any other way to set credentials before making this call. But I am not able to generate/extract that token value.

Setting our Authentoicator (as in example) in ws translator also didnt work.

Authenticator.setDefault(new Authenticator() {

            @Override

            public PasswordAuthentication getPasswordAuthentication() {

                return new PasswordAuthentication(domain + "\\" + userName, password.toCharArray());

            }

        });

Any idea?

[rareddy]

First you need a  LoginModule, based on link I gave above, use JCIFS library and use the subject that in the context or passed though the configuration of the login module. Once you have that, then you need to use this as "security-domain" on your "ws" resource-adapter. Then you need to figure out how convert the subject's credential into NTLM token in "ws" resource-adapter, not in translator.

[sanjay_chaturvedi]

Thanks for support, BTW custom ws-resource adapter would not be that much straight as it has final inner classes.

[shawkins]

If you find a way to make your scenario work, then we should be able to include those changes or refactor so that an extension would be possible.

[sanjay_chaturvedi]

similarly, I guess we don't have any in build support for SSO authentication while calling web service in teiid ?

[shawkins]

What do you mean by build support?

The latest versions of Teiid have been adding support for several SSO flows around kerberos.

[rareddy]

And OAuth 1.0 & OAuth2.0