Authenticating webservices in an NTLM environment

marcus — Wed, 12 Dec 2007 02:47:19 GMT

Some quick background to the system architecture first;1. Alfresco 2.1 system "AlfrescoProd" running on server A, configured to authenticate via NTLM against Active Directory on domain THEDOMAIN2. Custom java application "AceApp" running on server B, which also authenticates via NTLM against Active

Re: Authenticating webservices in an NTLM environment

marcus — Wed, 12 Dec 2007 04:49:20 GMT

To follow up, there's a method that I know works, but takes advantage of some cross site request forgery stuff that could be exploited if used nefariously, which is why I'm hoping there's a less exploitable way of doing things

Create the following in Data Dictionary/Scripts/key.js


var output = 'var _ALF_TICKET = "'+session.ticket+'";';
output;
‍‍‍‍

Add the following to your own application


<script type="text/javascript" src="http://alfresco.domain:8080/alfresco/command/script/execute?scriptPath=/Company%20Home/Data%20Dictionary/Scripts/key.js"></script>

<script type="text/javascript">
   // if _ALF_TICKET now exists, lets refresh with it as a parameter
   if (_ALF_TICKET != null) {
      // use some ajax to blast _ALF_TICKET back into your application and bounce off to the next page
   }
</script>
‍‍‍‍‍‍‍‍‍‍

topic Authenticating webservices in an NTLM environment in Alfresco Archive

Authenticating webservices in an NTLM environment

Re: Authenticating webservices in an NTLM environment