Repository navigation
How to perform ntlm authentication when using alpine as base image? #87568
Description
Hello,
We have followed the steps suggested here but, nothing is working. We are trying to run the application in Azure AKS. Any suggestions please
Code
var cred= new CredentialCache();
cred.Add(new Uri("url"), "NTLM", new NetworkCredential("user", "pwd", "***.com"));
var hwd= new HttpClientHandler() { Credentials = credentialsCache, PreAuthenticate = true };
hwd.ClientCertificateOptions = ClientCertificateOption.Manual;
hwd.ServerCertificateCustomValidationCallback =
(httpRequestMessage, cert, cetChain, policyErrors) => true;
hwd.UseDefaultCredentials = false;
var client = new FlurlClient(new HttpClient(hwd) { Timeout = new TimeSpan(0, 0, 30) };);
var response = await request
.AllowHttpStatus(HttpStatusCode.NotFound)
.WithHeader("Accept", "application/json")
.WithClient(client)
.WithHeader("Content-Type", "application/json; charset=utf-8")
.GetAsync();
Exception
Flurl.Http.FlurlHttpException: Call failed. NTLM authentication is not possible with default credentials on this platform:
System.PlatformNotSupportedException: NTLM authentication is not possible with default credentials on this platform. at
POD base image
NAME="Alpine Linux"
ID=alpine
VERSION_ID=3.16.3
PRETTY_NAME="Alpine Linux v3.16"
dotnet version:- 6.0.14
Activity
mthalman commentedon Jun 14, 2023
[Triage] Moved to runtime repo since this isn't a Docker-specific question. This is strictly runtime-related and its interop with Alpine.
wfurt commentedon Jun 15, 2023
The steps in link are conceptually right @smartaquarius10. .NET uses authentication layer from OS (e.g. GSSAPI) and it ls limited by OS capabilities. The sequence modifies alpine to add support for NTLM to GSSAPI.
You can possibly build and run something from https://github.com/davidsh/NetworkingTests/tree/master/gssapitests to see if the mechanism was added correctly.
now, the exception is about default credentials. You only added NTLM to CredentialCache. Are you sure that server is not sending
Negotiatescheme? Either get packet captures or simply add theNegotiateas well.For .NET 7.0 you can possibly use NegotiateAuthentication directly but that is not available in 6.
smartaquarius10 commentedon Jun 15, 2023
@wfurt I used this docker file.. Everything build but after that this error started coming
GSSAPI operation failed with error - No credentials were supplied, or the credentials were unavailable or inaccessible (kdc reply did not match expectations).wfurt commentedon Jun 15, 2023
smartaquarius10 commentedon Jun 15, 2023
@wfurt I dont know how to run this packet capture tool in a container in kubernetes
4 remaining items
smartaquarius10 commentedon Jun 15, 2023
@wfurt I have the curl command for that as well.. Can I use these tools with curl command
smartaquarius10 commentedon Jun 15, 2023
@wfurt I have checked in google chrome developer tools.. This is coming in response headers
wfurt commentedon Jun 15, 2023
right. so the code fragment you originally posted will not work as "NTLM" does not match "Negotiate". Did you add the
Negotiatemechanism as I suggested?smartaquarius10 commentedon Jun 15, 2023
Should we add this negotiate along with building gssntlm package inside alpine
wfurt commentedon Jun 15, 2023
Yes. There are two flavors of NTLM - one specific and one where it can be decided by "negotiation". Both need GSSAPI support at the and and this is what the extra steps should provide.
Because you created credential cache for NTLM and server offered Negotiate the credentials will be ignored.
smartaquarius10 commentedon Jun 18, 2023
@wfurt After banging my head with this alpine I have finally shifted to the base image of debian type flavour. I need to complete this migration otherwise there will be a big money loss.
However, by any chance can u suggest the lightest debian type base image for .net app. I have used
bullseye slimand tried self contained .net app withpublishtrim=truestill its 374 mb of file. Any suggestions to decrease the size.I have also asked this question here
wfurt commentedon Jun 19, 2023
this is more question for Linux distribution people. There will be some unfixable difference IMHO e.g. glibc vs musl-libc. You can probably make list of packages and start removing the one you do not need. Package manager should tell you if you cut something you need.
long term, best solution may be contributing gss-ntlm package to Alpine.
smartaquarius10 commentedon Jun 19, 2023
@wfurt Definitely.. GSS-ntlm has to be in alpine..