<filter> <filter-name>NtlmHttpFilter</filter-name> <filter-class>jcifs.http.NtlmHttpFilter</filter-class> <init-param> <param-name>jcifs.netbios.wins</param-name> <param-value>10.169.10.77,10.169.10.66</param-value> </init-param> <init-param> <param-name>jcifs.smb.client.domain</param-name> <param-value>NYC-USERS</param-value> </init-param> <init-param> <param-name>jcifs.smb.client.username</param-name> <param-value>somenycuser</param-value> </init-param> <init-param> <param-name>jcifs.smb.client.password</param-name> <param-value>AReallyLoooongRandomPassword</param-value> </init-param> </filter> <filter-mapping> <filter-name>NtlmHttpFilter</filter-name> <url-pattern>/*</url-pattern> </filter-mapping>The above will authenticate users accessing all content against the domain NYC-USERS. The WINS server 10.169.10.77 will be queried to resolve NYC-USERS to an IP address of a domain controller. If that WINS server is not responding, 10.169.10.66 will be queried. This example is suitable for large numbers of concurrent users because jCIFS will cycle through domain controllers and use an alternate WINS servers if necessary. In combination with the domain property, if a username and password are specified then preauthentication will be used. Preauthentication is necessary to initialize the SMB signing digest (see section on SMB signatures). Note: If you do not use WINS you must use the Explicit Domain Controller web.xml Example below or apply and use the DnsSrv.patch in the patches directory which uses JNDI to perform DNS SRV lookups for domain controllers.
<filter> <filter-name>NtlmHttpFilter</filter-name> <filter-class>jcifs.http.NtlmHttpFilter</filter-class> <init-param> <param-name>jcifs.http.domainController</param-name> <param-value>192.168.2.15</param-value> </init-param> <!-- always needed for preauthentication / SMB signatures --> <init-param> <param-name>jcifs.smb.client.domain</param-name> <param-value>NYC-USERS</param-value> </init-param> <init-param> <param-name>jcifs.smb.client.username</param-name> <param-value>somenycuser</param-value> </init-param> <init-param> <param-name>jcifs.smb.client.password</param-name> <param-value>AReallyLoooongRandomPassword</param-value> </init-param> </filter> <filter-mapping> <filter-name>NtlmHttpFilter</filter-name> <url-pattern>/*</url-pattern> </filter-mapping>Note: This example will only work with with jcifs-1.2.8 or above. Prior to this version there was a logical bug in the preauthentication code that would cause signatures to fail resulting in repeated Access denied errors which in turn would cause the Network Password Dialog to appear regardless of what credentials were entered.
<filter> <filter-name>NtlmHttpFilter</filter-name> <filter-class>jcifs.http.NtlmHttpFilter</filter-class> <init-param> <param-name>jcifs.http.domainController</param-name> <param-value>192.168.2.15</param-value> </init-param> <!-- permissions on \\192.168.2.15\JcifsAcl share gate web access --> <init-param> <param-name>jcifs.smb.client.logonShare</param-name> <param-value>JcifsAcl</param-value> </init-param> <!-- always needed for preauthentication / SMB signatures --> <init-param> <param-name>jcifs.smb.client.domain</param-name> <param-value>NYC-USERS</param-value> </init-param> <init-param> <param-name>jcifs.smb.client.username</param-name> <param-value>somenycuser</param-value> </init-param> <init-param> <param-name>jcifs.smb.client.password</param-name> <param-value>AReallyLoooongRandomPassword</param-value> </init-param> </filter> <filter-mapping> <filter-name>NtlmHttpFilter</filter-name> <url-pattern>/*</url-pattern> </filter-mapping>Note: Do not use a share that has files in it. JCIFS tries to list the contents of the share to determine if the user has access so it is more efficient if there's nothing in it. Running the NtlmHttpAuthExample.java example should be a suitable test of the Filter.
The significance of the POST test is that after negotiating NTLM HTTP Authentication once, IE will not POST any form data until it has negotiated the password hashes again (more about this below). If the NTLM HTTP Authentication Filter is not enabled something like the following will be displayed:NTLM HTTP Authentication Example
NYC-USERS\MIALLEN successfully logged inPlease submit some form data using POST
field1 = hello
null successfully logged inNotice the user was permitted access. Unlike this example, developers might add an additional check to make sure getRemoteUser does not return null.
jcifs.smb.client.domain | The NT domain against which clients should be authenticated. Generally it is necessary to also set the jcifs.netbios.wins parameter or a domain controller may not be found. This parameter will be ignored for NTLM HTTP authentication purposes if a jcifs.http.domainController property is specified (although they can be used together for "preauthenctication" as described in the SMB Signatures and Windows 2003 section below). |
jcifs.http.domainController | The IP address of any SMB server that should be used to authenticate HTTP clients with the NtlmHttpFilter class. If this is not specified the jcifs.smb.client.domain 0x1C NetBIOS group name will be queried. If these queries fail an UnknownHostException will be thrown. It is not necessary for this to specify a real domain controller. The IP address of a workstation will do for simple purposes. You can also use a DNS name however if you do this you should also set jcifs.resolveOrder=DNS. Otherwise, the client may waste time trying to resolve the name using WINS. |
jcifs.http.basicRealm | The realm for basic authentication. This property defaults to 'jCIFS'. |
jcifs.http.enableBasic | Setting this property to true enables basic authentication over HTTPS only. |
jcifs.http.insecureBasic | Setting this property to true enables basic authentication over plain HTTP. This configuration passes user credentials in plain text over the network. It should not be used in environment where security is required. |
jcifs.http.loadBalance | If a jcifs.smb.client.domain property is specified (and domainController is not specified) the NtlmHttpFilter will query for domain controllers by name. If this property is true the Filter will rotate through the list of domain controllers when authenticating users. The default value is true. The jcifs.netbios.lookupRespLimit property can also be used to limit the number of domain controllers used. |
jcifs.netbios.lookupRespLimit | The 0x1C NetBIOS name query returns a list of domain controllers. It is believed that the servers at the top of this list should be favored. This property limits the range of servers returned by name queries. The default value is 5 meaning the top 5 domain controllers will be used. |
jcifs.netbios.wins | The IP address of the WINS server. This is required when accessing hosts on different subnets (like a domain controller by name) and it is highly recommended if a wins server is available. |
jcifs.smb.client.laddr | The ip address of the local interface the client should bind to if it is different from the default. For example if jCIFS is used to authenticate clients on one interface and the domain controller for those clients is accessible only on another interface of a webserver with two NICs it may be necessary to specify which interface jCIFS should use. |
jcifs.netbios.laddr | The ip address of the local interface the client should bind to for name queries if it is different from the default. Likely set to the same as the above property. |
jcifs.smb.client.attrExpirationPeriod |
Attributes of a file are cached for attrExpirationPeriod milliseconds. The default is 5000 but the NetworkExplorer servlet will attempt to set this property to 120000. Otherwise, when listing large directories, the attributes of SmbFiles may expire within the default period resulting in a large number of additional network messages and severe performance degradation.
|
jcifs.smb.client.soTimeout | To prevent the client from holding server resources unnecessarily, sockets are closed after this time period if there is no activity. This time is specified in milliseconds. The default is 35000 however when NTLM HTTP Authentication is used, the NtlmHttpFilter will attempt to set this value to 5 minutes so that frequent calls to SmbSession.logon() do not provoke redundant messages being submitted to the domain controller. If it is not desirable to cache password hashes set this value back to 35000. |
jcifs.netbios.cachePolicy | When a NetBIOS name is resolved with the NbtAddress class it is cached to reduce redundant name queries. This property controls how long, in seconds, these names are cached. The default is 30 seconds, 0 is no caching, and -1 is forever. When NTLM HTTP Authentication is used, NtlmHttpFilter will attempt to set this value to 20 minutes so that frequent queries for a domain controller will be cached. |
jcifs.util.loglevel | A value that indicates the detail of logging messages. Values are approxamitly as follows: 0: Nothing 1: Critical [default] 2: Basic info. (Can be logged under load) 3: Detailed info. (Highest recommended level for production use) 4: Individual smb messages 6: Hex dumps |
<Context> ... <Manager pathname=""/> <!-- disable session persistence --> </Context>Tomcat requires that all filter directives be adjacent to one another, all filter-mapping directives appear adjacent to one another, all servlet directives ... and so on. This is because Tomcat validates the web.xml against the deployment descriptor DTD (why the DTD would require such a thing I don't know).
Exception MalformedURLException: unknown protocol: smb at java.net.URL.(URL.java:480) at java.net.URL.(URL.java:376) at java.net.URL.(URL.java:330) at jcifs.smb.SmbFile.(SmbFile.java:355) ...
<init-parameter> <parameter-name>jcifs.netbios.hostname</parameter-name> <parameter-value>MYHOSTNAME</parameter-value> </init-parameter>
Type: DWORD Key: HKEY_CURRENT_USER/Software/Microsoft/Windows/CurrentVersion/Internet Settings/DisableNTLMPreAuth Value: 1
http://davenport.sourceforge.net/ntlm.html
http://www.innovation.ch/java/ntlm.html