3

We're developing a Java SE application that is to be deployed at corporate customer sites. Using http the application needs to access the Internet from time to time and does so using URL.openConnection(java.net.Proxy) which in effect means HttpURLConnection.

We are looking to give the application user the same experience that comes with the major browsers meaning that if the major browsers (IE, Firefox, Chrome) can pass through a given proxy then so should our application.

We are assuming that corporate proxy servers in this day and age use some form of promptless authentication (NTLM, SPNEGO). To this end we end have two concrete questions:

  1. Can HttpURLConnection pass through a proxy that requires NTLMv2 authentication ?. Looking through the JDK source code it seems there's support for NTLM but nowhere can I find any documentation as to what version of NTLM is supported. I've trawled through all release notes since JDK5.

  2. Can HttpURLConnection pass through a proxy that uses SPNEGO-Kerberos authentication ? (without requiring changes to customer's desktops, e.g. forget about registry changes).

The target desktop platform for our application is Windows 7 (or later).

The JVM used is Oracle Java v7 or later.

In general there's no room for making changes to our customer's desktops for the sake of our application. It won't happen if it's a scenario that the major browsers can handle without changes. So we need to assess what Java can do for us. We are using a third-party library for some of the comms and this library in turn uses standard JDK classes (e.g. URL.openConnection()). We are aware that Apache HttpComponents Client (formerly Apache HttpClient) is an alternative and we are willing to rip out this third party library to be able to replace with Apache HttpComponents Client if that solution is truly better in terms of being a able to pass through a proxy.

Community
  • 1
  • 1
peterh
  • 18,404
  • 12
  • 87
  • 115
  • It's not possible without a wrapper like jcifs, an example using HttpURLConnection : http://stackoverflow.com/a/34321230/2073804 – ron190 Dec 20 '15 at 02:46

1 Answers1

1

First one, yes. Custom code from Sun which calls SSPI via JNI will react on NTLM on Windows only.

Second, no. This is a MS resctriction. Unless you code a SSPI JGSS bridge. You maybe could swap the Authenticator for a custom one.

Michael-O
  • 18,123
  • 6
  • 55
  • 121
  • Thanks for answering. Appreciated!. Re: NTLM: How do you know? Is there anywhere where this is stated ? Re Kerberos: If it was a MS restriction then how come Chrome, Firefox, etc can make it work (where Java can't) ? – peterh Jun 17 '14 at 10:31
  • @nolan6000, NTLM: I read the source code of the JDK. Kerberos: They all use SSPI directly, where everything is opaque to the user. The user does not have real access to the TGT but through the LSA/SSPI only. SSPI == Windows GSS-API implementation. JGSS = Java GSS-API implemenation. – Michael-O Jun 17 '14 at 10:39