October 2007
NTLM HTTP Authentication is insecure by design
by nhoizey
This write-up discusses a problem inherent to the situation of a connection-oriented authentication - authorization protocol (e.g. NTLM authentication) used with a proxy server that shares TCP connections among several clients
The NTLM Authentication Protocol
by nhoizey
This article seeks to describe NTLM at an intermediate to advanced level of detail, suitable as a reference for implementors.
NTLM - Central Authentication Service - JA-SIG Wiki
by nhoizey
SAMBA has a Java JAR that performs the NTLM challenge dialog from a Servlet. It runs as a Servlet Filter in front of an application. If the remote user pass the challenge, the userid is stored in the Request block when the CAS Servlet begins processing
December 2006
1
(4 marks)
