How to perform ntlm authentication when using alpine as base image?

[smartaquarius10]

Hello,

We have followed the steps suggested here but, nothing is working. We are trying to run the application in Azure AKS. Any suggestions please

Code

               var cred= new CredentialCache();
                cred.Add(new Uri("url"), "NTLM", new NetworkCredential("user", "pwd", "***.com"));

                var hwd= new HttpClientHandler() { Credentials = credentialsCache, PreAuthenticate = true };
                
                hwd.ClientCertificateOptions = ClientCertificateOption.Manual;
                hwd.ServerCertificateCustomValidationCallback =
                    (httpRequestMessage, cert, cetChain, policyErrors) => true;
                hwd.UseDefaultCredentials = false;

                var client = new FlurlClient(new HttpClient(hwd) { Timeout = new TimeSpan(0, 0, 30) };);
                 var response = await request
                    .AllowHttpStatus(HttpStatusCode.NotFound)
                    .WithHeader("Accept", "application/json")
                    .WithClient(client)
                    .WithHeader("Content-Type", "application/json; charset=utf-8")
                    .GetAsync();

Exception

Flurl.Http.FlurlHttpException: Call failed. NTLM authentication is not possible with default credentials on this platform: 
System.PlatformNotSupportedException: NTLM authentication is not possible with default credentials on this platform. at

POD base image

NAME="Alpine Linux"
ID=alpine
VERSION_ID=3.16.3
PRETTY_NAME="Alpine Linux v3.16"

dotnet version:- 6.0.14

Tagging subscribers to this area: @dotnet/ncl
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Hello,

We have followed the steps suggested here but, nothing is working. We are trying to run the application in Azure AKS. Any suggestions please

Code

               var cred= new CredentialCache();
                cred.Add(new Uri("url"), "NTLM", new NetworkCredential("user", "pwd", "***.com"));

                var hwd= new HttpClientHandler() { Credentials = credentialsCache, PreAuthenticate = true };
                
                hwd.ClientCertificateOptions = ClientCertificateOption.Manual;
                hwd.ServerCertificateCustomValidationCallback =
                    (httpRequestMessage, cert, cetChain, policyErrors) => true;
                hwd.UseDefaultCredentials = false;

                var client = new FlurlClient(new HttpClient(hwd) { Timeout = new TimeSpan(0, 0, 30) };);
                 var response = await request
                    .AllowHttpStatus(HttpStatusCode.NotFound)
                    .WithHeader("Accept", "application/json")
                    .WithClient(client)
                    .WithHeader("Content-Type", "application/json; charset=utf-8")
                    .GetAsync();

Exception

Flurl.Http.FlurlHttpException: Call failed. NTLM authentication is not possible with default credentials on this platform: 
System.PlatformNotSupportedException: NTLM authentication is not possible with default credentials on this platform. at

POD base image

NAME="Alpine Linux"
ID=alpine
VERSION_ID=3.16.3
PRETTY_NAME="Alpine Linux v3.16"

dotnet version:- 6.0.14

Author:	smartaquarius10
Assignees:	-
Labels:	area-System.Net.Http, untriaged
Milestone:	-

[mthalman]

[Triage] Moved to runtime repo since this isn't a Docker-specific question. This is strictly runtime-related and its interop with Alpine.

[wfurt]

The steps in link are conceptually right @smartaquarius10. .NET uses authentication layer from OS (e.g. GSSAPI) and it ls limited by OS capabilities. The sequence modifies alpine to add support for NTLM to GSSAPI.

You can possibly build and run something from https://github.com/davidsh/NetworkingTests/tree/master/gssapitests to see if the mechanism was added correctly.

now, the exception is about default credentials. You only added NTLM to CredentialCache. Are you sure that server is not sending Negotiate scheme? Either get packet captures or simply add the Negotiate as well.

For .NET 7.0 you can possibly use NegotiateAuthentication directly but that is not available in 6.

[smartaquarius10]

@wfurt I used this docker file.. Everything build but after that this error started coming

GSSAPI operation failed with error - No credentials were supplied, or the credentials were unavailable or inaccessible (kdc reply did not match expectations).

[wfurt]

1. Check if the container GSSAPI supports NTLM - using the tools I posted.
2. Figure out if the authentication is doing pure NTLM or if this is on Negotiate path (that can do NTLM as well)

This issue has been marked needs-author-action and may be missing some important information.

[smartaquarius10]

@wfurt I dont know how to run this packet capture tool in a container in kubernetes