NTLM not working on Linux

[stevenruizhang]

@davidsh , I create one .net core 2.1 project and can run will in my local windows OS. But when i follow the AWS toolkit for VS tool to push that in AWS lambda it will throw GSSAPI issue. I check this is regarding NTLM auth does not work by default on Unix issue, I setup Ubuntu 16.04 VM local and run apt-get -y install gss-ntlmssp, also add AppContext.SetSwitch("System.Net.Http.UseSocketsHttpHandler", false) in the dotnet code, finally i got 401 error in ubuntu, do u have any idea how to resolve that ?
Before install gss-ntlmssp and add AppContext.SetSwitch

After install gss-ntlmssp and add AppContext.SetSwitch

Originally posted by @stevenruizhang in https://github.com/dotnet/corefx/issues/28961#issuecomment-498299281

[davidsh]

@davidsh , I create one .net core 2.1 project and can run will in my local windows OS.

The NTLM bug you reference in #25827 was fixed in .NET Core 3.0. It is not fixed in .NET Core 2.1.

Please try out .NET Core 3.0 latest Preview:
https://devblogs.microsoft.com/dotnet/announcing-net-core-3-0-preview-5/

If you are still having problems, please update this issue and include the code sample that you are using. From the screenshot above, it appears you are using WebRequest. But it is not clear how you are setting up credentials for your application.

[davidsh]

Also, do not use this code in your application:

AppContext.SetSwitch("System.Net.Http.UseSocketsHttpHandler", false)

It will not help. The NTLM fixes require the new SocketsHttpHandler. So, you shouldn't be turning it off with that app context switch.

[stevenruizhang]

@davidsh , please see below steps , i want to firstly test in my local ubuntu if passed, then i can ask AWS team if u can install the gss-ntlmssp library in the lambda vm or they can use .NET Core 3.0 latest Preview directly. see related issue https://github.com/dotnet/corefx/issues/38157

1. i use .net core 2.1 in VS 2017 to push the code, and that code can run well in my local
2. i remove the AppContext.SetSwitch("System.Net.Http.UseSocketsHttpHandler", false); code as u suggested
3. i use the below code to setup the credential
   
4. i check API which i used has below header for www-authenticate in POST man tool
   
5. put the pushed code in my local linux VM , still get below error
   
   My concers:
   a) how can i use .net core 2.1 run success in my local VM ubuntu , only to install the gss-ntlmssp library is enough any other library is needed? the credential set up above is fine?
   b) if .net core 2.1 can not resolve this issue, we had to use .NET Core 3.0 latest Preview, no any library and code need to change when use for .NET Core 3.0, i think even i can pass that in my local but AWS lambda only support up to .net core 2.1
   c) is the issue related to linux version , my local vm is ubuntu 16.04 but the lamdba VM os is
   the Linux kernel version is 4.14.88-90.76.amzn2.x86_64 or 4.14.94-73.73.amzn1.x86_64 according to AWS doc

[davidsh]

.NET Core 3.0 still requires the gss-ntlmssp package to be installed in a Linux VM.

[stevenruizhang]

@davidsh could u answer the other questions below , thanks
a) how can i use .net core 2.1 run success in my local VM ubuntu , only to install the gss-ntlmssp library is enough any other library is needed? the credential set up above is fine?
b) if .net core 2.1 can not resolve this issue, we had to use .NET Core 3.0 latest Preview, no any library and code need to change when use for .NET Core 3.0, i think even i can pass that in my local but AWS lambda only support up to .net core 2.1
c) is the issue related to linux version , my local vm is ubuntu 16.04 but the lamdba VM os is
the Linux kernel version is 4.14.88-90.76.amzn2.x86_64 or 4.14.94-73.73.amzn1.x86_64 according to AWS doc

[davidsh]

.NET Core 2.1 has bugs that are only fixed in .NET Core 3.0. Specifically Negotiate protocol won't auto-fallback from kerberos to NTLM. So your a) won't work.

b) is not true either. You need to install gss-ntlmssp to use NTLM protocol even with .NET Core 3.0.

c) The issue is not related to linux version.

The basic requirements are:

• .NET Core 3.0.
• Install gss-ntlmssp package to the Linux VM

[davidsh]

Also, you cannot use "Default Credentials" on Linux with NTLM. There is no such thing because there is no default identity on Linux.

So, code like this won't work on Linux with NTLM:

request.Credentials = CredentialCache.DefaultCredentials;

Using DefaultCredentials only work when a Linux VM is correctly configured and joined to a Kerberos realm or Windows Active Directory domain. And you must pre-initialize the credential with a "kinit" command.

However, you can use explicit credentials such as:

request.Credentials = new NetworkCredentials(username, password, domain);

[davidsh]

It sounds like your issue is actually the same as dotnet/corefx#35383. And that requires .NET Core 3.0 as well as the gss-ntlmssp package to be installed.

[davidsh]

Please try out .NET Core 3.0 with your Linux VM and install the gss-ntlmssp package. If you are still having trouble with Negotiate or NTLM authentication, then we can re-open this issue.

[stevenruizhang]

i will try , thanks

[math084m]

@stevenruizhang Will you please confirm if you got it to work or not?
I am currently struggling with the same issue.

[stevenruizhang]

it can work well with .NET Core 3.0 with my Linux VM and install the gss-ntlmssp package in my local VM machine