Splunk Apps » Website Monitoring

Can test here: http://ntlm.herokuapp.com/

Or using http://blog.michelbarneveld.nl/michel/archive/2009/12/05/kerberos-authentication-tester.aspx or this: https://blogs.msdn.microsoft.com/friis/2013/01/08/asp-net-authentication-test-page/

See here for details: http://serverfault.com/questions/595035/testing-ntlm-kerberos-against-a-public-url

Might want to add kerberos authentication https://pypi.python.org/pypi/requests-kerberos or https://github.com/requests/requests-kerberos

It turns out that authentication auto detection wasn't working correctly. The headers are returned in lowercase (see https://github.com/kennethreitz/requests/issues/1561) but the app assumed they would be in the original case.

It turns out that the auth header can be a tuple: https://github.com/chimurai/http-proxy-middleware/issues/39

https://blogs.msdn.microsoft.com/chiranth/2013/09/20/ntlm-want-to-know-how-it-works/

I faked an NTLM session;

1. Server responds with 401 and Www-Authenticate: NTLM
2. Client provides challenge Authorization: NTLM TlRMTVNTUAABAAAAB4IIAAAAAAAAAAAAAAAAAAAAAAA=
3. Server responds with 401 and Www-Authenticate: NTLM TlRMTVNTUAACAAAAAAAAACgAAAABAAAAAAAAAAAAAAA=
4. Client provides Authorization: NTLM TlRMTVNTUAADAAAAGAAYAGwAAAAYABgAhAAAAAgACABAAAAACAAIAEgAAAAcABwAUAAAAAAAAAAAAAAAAQAAAHQAZQBzAHQAdABlAHMAdABsAG0AdQByAHAAaABlAHkALQBtAGIAcAAxADUAgiKGu7ODU4Zx7W3Y2A23BfV9JN+XMe+FgiKGu7ODU4Zx7W3Y2A23BfV9JN+XMe+F
5. Server responds with a 200