Integrated Windows Authentication

Smart GWT Technical Q&A
1

I am looking for advice on the topic of IWA (a.k.a Kerberos) and Smart GWT.

I have an environment that has IWA enabled among its IIS servers and IE web browsers. This type of configuration delivers a true single sign-on experience to the user (e.g. log into a desktop once and your are done with authentication). HTTP headers are used to negotiate the authentication handshake between the web browser and the web server. Ultimately, a properly configured IE web browser will deliver the user’s encrypted Kerberos token to IIS where it is decoded and the user is authenticated and granted access to the requested content.

Since this handshake falls outside of the Smart GWT data source protocol, I was wonder if I should anticipate issues using the library. When the GET method is invoked via the RestDataSource, should I expect the browser to generate and handle the same HTTP headers it would if I were using vanilla HTML with a FORM-based submission to the server?

Any insight this community can share on the topic would be most appreciated.

2

An XMLHttpRequest from eg a RestDataSource will send normal HTTP cookies - if that’s the mechanism in use here, it should be fine.

3

Sample HTTP Header Protocol

We are exchanging much more than cookies in the headers.

Example: The initial request using GET

GET /search?q=kerberos&btnG=Google+Search&access=a&oe=UTF-8&ie=UTF-8&sort=date%
3AD%3AL%3Ad1&client=default_frontend&entqr=0&ud=1&output=xml_no_dtd
&proxystylesheet=default_frontend HTTP/1.1
Host: gsa1.yourdomain.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.8.1.17) Gecko/20080829 Firefox/2.0.0.17
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive

HTTP/1.x 401 Unauthorized
Connection: Close
Set-Cookie: GSA_SESSION_ID=05cc29ee2b1ca77fb955438a8e76a3bd
WWW-Authenticate: Negotiate
WWW-Authenticate: NTLM
WWW-Authenticate: Realm="YOURDOMAIN.COM"
Content-Type: text/html
Content-Length: 87

Example: The browser responds with the Kerberos token encrypted

GET /search?q=kerberos&btnG=Google+Search&access=a&oe=UTF-8&ie=UTF-8&sort=date
%3AD%3AL%3Ad1&client=default_frontend&entqr=0&ud=1&output=xml_no_dtd
&proxystylesheet=default_frontend HTTP/1.1
Host: gsa1.yourdomain.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.8.1.17) Gecko/20080829 Firefox/2.0.0.17
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Authorization: Negotiate YIIKogYGKwYBBQUCoIIKljCCCpKgJDAiBgkqhkiC9xIBAgI
GCSqGSIb3EgECAgYKKwYBBAGCNwICCqKCCmgEggpkYIIKYAYJKoZIhvcSAQICAQBuggpPMIIKS6ADAg
EFoQMCAQ6iBwMFACAAAACjggRXYYIEUzCCBE+gAwIBBaEPGw1FU09ET01BSU4uQ09NoiUwI6ADAgECo
RwwGhsESFRUUBsSZ3NhMS5lc29kb21haW4uY29to4IEDjCCBAqgAwIBA6EDAgEMooID/ASCA/jSMGzx
EoKacqRcAbwMnEe8eS2xkvKLCii9IiiTHdZNYCyB/vvMJAOeiexKZvQUJoJ4dDnARMnfUrpM1zhVBzZ
TuVu3Pin1ektYoBV+b+EP4P6GlfvqYq7unXeoteCE28Xa7OL02VKu1GSoUtP9Ivxe8TRXeJPF4Jtglz
EyREdMxIvsCOTH4ki7gnBd22BL1GkMFr5Oidq2zcw1moFeRq5fRvZFGq1uxWMUKReDzejeEcWooBt6h
5AndTtP4+fdHUr/VSfyIrtn2bAAenkpx2rADQkctHTL0WJ7DLeQpB0EBf1CqgmSnbXoJYqWeG+ht98a
Nla3senEZhGZXFOwqLIt2QRQbKMom8LlvdOrnDpSVuAc9Q1qs0xkzJ8J8aXeTmlFrY6bItqJ2T/9Mei
b5d3Ftdn6nPDveiCWB0WWk8hhRJHmBidoXRsJasibscra3t0lXDywYt+HON6HSaT1Q79w3xC9e86va/
rUyYhNZA8+pCTfAhqteblGedkyhrud+/8YLZTcdsMl1EXqnU+aji5r3g2SI1ZassUZ235cCsJcDj0Jp
CBp8QRMLoSUybDgzceyqRSWjvpxg7CmVJevpDFEE9UFfZFxCeRhZIdHRDjySV7U349Hyz2dgbyk3uzB
+5Z++bGhcUZWsGRkUkNg3LN+CmFj/H1dyhqQFETtVmhK/WKb2IQCjy/XteTCZEpAj4urSXco+O5yDm0
MCz9k1tfFEzpKkxukOrwdZIO8LwEsgy5AyRr7Z29ozbMSWq2nTDQz4nyqGeH/se8a4aO/2092ZdKfpc
AhXeChgJnXm08bQNcCsP8J9+Q4runca6b//ca8P2S9nDNzQowiiIcOix7i0OhHuXVjUEtx0zbXS6Cpl
+jU2Jey+BK2QyMklvi0YwBvAU2tURZVYCh4sC6FsMV0y4oc8dWpYpnmeXHm42v75+Fs5LnjwgEGsU=

Again, this handshake is normally handled by IE in the background. I just want to make sure that the XMLHttpRequest permits the same negotiation to take place.

4

Ah OK - basically we don’t know for sure, but we can tell you some findings from a related use case: if you go to a web page that has HTTP Basic Auth (not Kerberos) protecting it, the browser will prompt you for credentials with a dialog as usual, and from then on HTTP 401 challenges on XMLHttpRequests are handled transparently. However if you go to a page that is not protected by HTTP Basic Auth, then access a protected URL, there is no automatic handling (you might expect the request to be suspended and a native dialog shown for credentials), instead, your code will ultimately receive the 401 as a transport error.

The first scenario suggests that if you have natively logged into Windows it should automatically handle 401 challenges - but we have not tried this particular scenario.

Please do let us know what you find out.

5

HTMLPane

I have been considernig your feedback (which I appreciate) and wanted to propose a possible workaround.

I am thinking about using the HTMLPane (IFrame) widget to render the output from the web service protected by IWA (Kerberos). My thinking is that the IFrame would operate much like the main web page and web browser should handle the negotiation properly verses the issues that XMLHttpRequest seems to have.

This would be a hybrid approach (which is OK for this particular application) - I will be able to use Smart GWT for the widgets around the HTMLPane, but the presentation within it will be driven by the web service I am contacting.

I will try to confirm this works over the next couple of days. Can you see any obvious issues?

Thanks.

6

Workaround Confirmed

Final note for this thread - I was able to use HTMLPane to render my results and the Kerberos handshake was successfully negotiated. This was not an ideal solution, but it will meet my requirements.

7

Just curious if you confirmed that it is not handled automatically for XMLHttpRequest, or if you just went straight to the HTMLPane / IFrame approach?

8

An early prototype using a simple Grid widget with a RestDataSource did not authenticate properly. This particular site still has IE 6 deployed and I just felt that my risk factors were too high to follow my original game plan.

I will likely revisit the Grid prototype testing once they upgrade to IE 8 later this year. If the news is good, I will post it here.