* Trying 10.16.81.156...
* TCP_NODELAY set
* Connected to remote-server (10.16.81.156) port 80 (#0)
* Server auth using NTLM with user ''
> GET /test-auth HTTP/1.1
> Host: remote-server
> Authorization: NTLM TlRMTVNTUAABAAAAB7IIogkACQAqAAAAAgACACgAAAAGAbEdAAAAD1ZNV0
9SS0dST1VQ
> User-Agent: curl/7.54.1-DEV
> Accept: */*
>
< HTTP/1.1 401 Unauthorized
< Content-Type: text/html; charset=us-ascii
< Server: Microsoft-HTTPAPI/2.0
< WWW-Authenticate: NTLM TlRMTVNTUAACAAAABAAEADgAAAAFgomir/ZxK+uKVEIAAAAAAAAAAHI
AcgA8AAAABgGxHQAAAA9LAEwAAgAEAEsATAABABIATgBPAFYASQBLAE8AVgAtAFAABAAMAGEAdgBwAC4
AcgB1AAMAIABuAG8AdgBpAGsAbwB2AC0AcAAuAGEAdgBwAC4AcgB1AAUADABhAHYAcAAuAHIAdQAHAAg
Ad7UWYB7w0gEAAAAA
< Date: Wed, 28 Jun 2017 14:53:59 GMT
< Content-Length: 341
<
* Ignoring the response-body
* Connection #0 to host remote-server left intact
* Issue another request to this URL: 'http://remote-server/test-auth'
* Found bundle for host remote-server: 0x67c490 [can pipeline]
* Re-using existing connection! (#0) with host remote-server
* Connected to remote-server (10.16.81.156) port 80 (#0)
* Server auth using NTLM with user ''
> GET /test-auth HTTP/1.1
> Host: remote-server
> Authorization: NTLM TlRMTVNTUAADAAAAGAAYAGwAAAD6APoAhAAAAAQABABYAAAADAAMAFwAAA
AEAAQAaAAAAAAAAAB+AQAABYKIogYBsR0AAAAPnY5BsWXZfbo+yiqNhj57Z1YATQBWAE0AVwBhAHIAZQ
BWAE0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAG0omJJ4aCwoSDUMF808rDQEBAAAAAAAAd7UWYB7w0g
EGkqTp1j8rAgAAAAACAAQASwBMAAEAEgBOAE8AVgBJAEsATwBWAC0AUAAEAAwAYQB2AHAALgByAHUAAw
AgAG4AbwB2AGkAawBvAHYALQBwAC4AYQB2AHAALgByAHUABQAMAGEAdgBwAC4AcgB1AAcACAB3tRZgHv
DSAQYABAACAAAACAAwADAAAAAAAAAAAQAAAAAgAAB3Lkajk4OkQP0WHQH99odKOWwKgX64hPOYLgjnvV
lf+QoAEAAAAAAAAAAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAA==
> User-Agent: curl/7.54.1-DEV
> Accept: */*
>
< HTTP/1.1 401 Unauthorized
< Cache-Control: private
< Content-Type: text/html; charset=utf-8
< Server: Microsoft-IIS/7.5
< WWW-Authenticate: Digest qop="auth",algorithm=MD5-sess,nonce="+Upgraded+v155a8
b3a152ed4ac80cf8d5067db93d0775491b601ef0d2010046dc605bf4df0800ee572ccb08f408cd4c
c29bbec116d5de4c6b05fdf6ffea",charset=utf-8,realm="Digest"
< WWW-Authenticate: Negotiate
* NTLM handshake rejected
* Authentication problem. Ignoring this.
< WWW-Authenticate: NTLM
< WWW-Authenticate: Basic realm="remote-server"
< X-Powered-By: ASP.NET
< Date: Wed, 28 Jun 2017 14:53:59 GMT
< Content-Length: 6538
<
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/x
html1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>IIS 7.5 Detailed Error - 401.1 - Unauthorized</title>
<style type="text/css">
<!--
body{margin:0;font-size:.7em;font-family:Verdana,Arial,Helvetica,sans-serif;back
ground:#CBE1EF;}
code{margin:0;color:#006600;font-size:1.1em;font-weight:bold;}
.config_source code{font-size:.8em;color:#000000;}
pre{margin:0;font-size:1.4em;word-wrap:break-word;}
ul,ol{margin:10px 0 10px 40px;}
ul.first,ol.first{margin-top:5px;}
fieldset{padding:0 15px 10px 15px;}
.summary-container fieldset{padding-bottom:5px;margin-top:4px;}
legend.no-expand-all{padding:2px 15px 4px 10px;margin:0 0 0 -12px;}
legend{color:#333333;padding:4px 15px 4px 10px;margin:4px 0 8px -12px;_margin-to
p:0px;
border-top:1px solid #EDEDED;border-left:1px solid #EDEDED;border-right:1px sol
id #969696;
border-bottom:1px solid #969696;background:#E7ECF0;font-weight:bold;font-size:1
em;}
a:link,a:visited{color:#007EFF;font-weight:bold;}
a:hover{text-decoration:none;}
h1{font-size:2.4em;margin:0;color:#FFF;}
h2{font-size:1.7em;margin:0;color:#CC0000;}
h3{font-size:1.4em;margin:10px 0 0 0;color:#CC0000;}
h4{font-size:1.2em;margin:10px 0 5px 0;
}#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet M
S",Verdana,sans-serif;
color:#FFF;background-color:#5C87B2;
}#content{margin:0 0 0 2%;position:relative;}
.summary-container,.content-container{background:#FFF;width:96%;margin-top:8px;p
adding:10px;position:relative;}
.config_source{background:#fff5c4;}
.content-container p{margin:0 0 10px 0;
}#details-left{width:35%;float:left;margin-right:2%;
}#details-right{width:63%;float:left;overflow:hidden;
}#server_version{width:96%;_height:1px;min-height:1px;margin:0 0 5px 0;padding:1
1px 2% 8px 2%;color:#FFFFFF;
background-color:#5A7FA5;border-bottom:1px solid #C1CFDD;border-top:1px solid #
4A6C8E;font-weight:normal;
font-size:1em;color:#FFF;text-align:right;
}#server_version p{margin:5px 0;}
table{margin:4px 0 4px 0;width:100%;border:none;}
td,th{vertical-align:top;padding:3px 0;text-align:left;font-weight:bold;border:n
one;}
th{width:30%;text-align:right;padding-right:2%;font-weight:normal;}
thead th{background-color:#ebebeb;width:25%;
}#details-right th{width:20%;}
table tr.alt td,table tr.alt th{background-color:#ebebeb;}
.highlight-code{color:#CC0000;font-weight:bold;font-style:italic;}
.clear{clear:both;}
.preferred{padding:0 5px 2px 5px;font-weight:normal;background:#006633;color:#FF
F;font-size:.8em;}
-->
</style>
</head>
<body>
<div id="header"><h1>Server Error in Application "DEFAULT WEB SITE"</h1></div>
<div id="server_version"><p>Internet Information Services 7.5</p></div>
<div id="content">
<div class="content-container">
<fieldset><legend>Error Summary</legend>
<h2>HTTP Error 401.1 - Unauthorized</h2>
<h3>You do not have permission to view this directory or page using the creden
tials that you supplied.</h3>
</fieldset>
</div>
<div class="content-container">
<fieldset><legend>Detailed Error Information</legend>
<div id="details-left">
<table border="0" cellpadding="0" cellspacing="0">
<tr class="alt"><th>Module</th><td>WindowsAuthenticationModule</td></tr>
<tr><th>Notification</th><td>AuthenticateRequest</td></tr>
<tr class="alt"><th>Handler</th><td>ExtensionlessUrlHandler-Integrated-4.0</
td></tr>
<tr><th>Error Code</th><td>0xc000006d</td></tr>
</table>
</div>
<div id="details-right">
<table border="0" cellpadding="0" cellspacing="0">
<tr class="alt"><th>Requested URL</th><td>http://remote-server:80/test-auth<
/td></tr>
<tr><th>Physical Path</th><td>C:\inetpub\wwwroot\test-auth</td></tr>
<tr class="alt"><th>Logon Method</th><td>Not yet determined</td></tr>
<tr><th>Logon User</th><td>Not yet determined</td></tr>
</table>
<div class="clear"></div>
</div>
</fieldset>
</div>
<div class="content-container">
<fieldset><legend>Most likely causes:</legend>
<ul> <li>The username supplied to IIS is invalid.</li> <li>The password
supplied to IIS was not typed correctly. </li> <li>Incorrect credential
s were cached by the browser.</li> <li>IIS could not verify the identity of
the username and password provided.</li> <li>The resource is configured f
or Anonymous authentication, but the configured anonymous account either has an
invalid password or was disabled.</li> <li>The server is configured to deny log
in privileges to the authenticating user or the group in which the user is a mem
ber.</li> <li>Invalid Kerberos configuration may be the cause if all of th
e following are true:</li> <ul> <li>Integrated authentication wa
s used.</li> <li>the application pool identity is a custom account.</
li> <li>the server is a member of a domain.</li> </ul> </ul>
</fieldset>
</div>
<div class="content-container">
<fieldset><legend>Things you can try:</legend>
<ul> <li>Verify that the username and password are correct, and are not cache
d by the browser.</li> <li>Use a different username and password.</li>
<li>If you are using a custom anonymous account, verify that the password has no
t expired.</li> <li>Verify that the authenticating user or the user's gr
oup, has not been denied login access to the server.</li> <li>Verify that
the account was not locked out due to numerous failed login attempts.</li>
<li>If you are using authentication and the server is a member of a domain, veri
fy that you have configured the application pool identity using the utility SETS
PN.exe, or changed the configuration so that NTLM is the favored authentication
type.</li> <li>Create a tracing rule to track failed requests for this HTTP
status code. For more information about creating a tracing rule for failed requ
ests, click <a href="http://go.microsoft.com/fwlink/?LinkID=66439">here</a>. </l
i> </ul>
</fieldset>
</div>
<div class="content-container">
<fieldset><legend>Links and More Information</legend>
This error occurs when either the username or password supplied to IIS is inva
lid, or when IIS cannot use the username and password to authenticate the user.
<p><a href="http://go.microsoft.com/fwlink/?LinkID=62293&IIS70Error=401,1,
0xc000006d,7601">View more information »</a></p>
<p>Microsoft Knowledge Base Articles:</p>
<ul><li>907273</li><li>871179</li><li>896861</li></ul>
</fieldset>
</div>
</div>
</body>
</html>
* Connection #0 to host remote-server left intact
I did this
On a Windows machine with logon user credentials that are accepted on the server NTLM authentication works ok:
curl -v -u : --ntlm localhost/test-auth
On a Windows machine where logon user credentials are not accepted on the server the user may add a credential record for that server to the Windows Credential Manager. In this case curl fails to authenticate on the server:
curl -v -u : --ntlm remote-server/test-auth
While on both machines Negotiate method works just fine.
curl -v -u : --negotiate localhost/test-auth
curl -v -u : --negotiate remote-server/test-auth
I expected the following
Both Negotiate and NTLM methods should work similarly, i.e. NTLM method should work when either logon user creds are accepted on the server, or there is a record for the server in Windows Credential Manager.
The solution is to provide host as an SPN to
InitializeSecurityContext()calls inntlm_sspi.cthe same way it is done inspnego_sspi.c.curl/libcurl version
operating system
Microsoft Windows [Version 6.1.7601]