在未经授权的请求后禁止NTLM对话框 [英] Suppress NTLM dialog box after unauthorized request

问题描述

在最近的一个sharepoint项目中，我实现了一个身份验证webpart，它应该取代NTLM身份验证对话框。只要用户提供有效的凭据，它就可以正常工作。每当用户提供无效凭据时，Internet Explorer中都会弹出NTLM对话框。

In a recent sharepoint project, I implemented an authentication webpart which should replace the NTLM authentication dialog box. It works fine as long as the user provides valid credentials. Whenever the user provides invalid credentials, the NTLM dialog box pops up in Internet Explorer.

通过XmlHttpRequest进行身份验证的我的Javascript代码如下所示：

My Javascript code which does the authentication via XmlHttpRequest looks like this:

function Login() {
   var request = GetRequest(); // retrieves XmlHttpRequest
   request.onreadystatechange = function() {
      if (this.status == 401) {     // unauthorized request -> invalid credentials
         // do something to suppress NTLM dialog box...
         // already tried location.reload(); and window.location = <url to authentication form>;
      }
   }
   request.open("GET", "http://myServer", false, "domain\\username", "password");
   request.send(null);
}

我不希望在用户提供时显示NTLM对话框无效证件。相反，应该执行身份验证表单中的登录按钮的回发。换句话说，浏览器不应该找到我未经授权的请求。

I don't want the NTLM dialog box to be displayed when the user provides invalid credentials. Instead the postback by the login button in the authentication form should be executed. In other words, the browser should not find out about my unauthorized request.

有没有办法通过Javascript做到这一点？

Is there any way to do this via Javascript?

推荐答案

马克的评论是正确的; NTLM auth提示符由401响应代码触发，并且NTLM的存在是WWW-Authenticate头中提供的第一个机制（参考： NTLM身份验证协议）。

Mark's comment is correct; The NTLM auth prompt is triggered by a 401 response code and the presence of NTLM as the first mechanism offered in the WWW-Authenticate header (Ref: The NTLM Authentication Protocol).

我不确定我是否正确理解了问题描述，但我认为你正在尝试为SharePoint包装NTLM身份验证，这意味着您无法控制服务器端身份验证协议，对吗？如果您无法操纵服务器端以避免在失败的凭据上发送401响应，那么您将无法避免此问题，因为它是（客户端）规范的一部分：

I'm not sure if I understand the question description correctly, but I think you are trying to wrap the NTLM authentication for SharePoint, which means you don't have control over the server-side authentication protocol, correct? If you're not able to manipulate the server side to avoid sending a 401 response on failed credentials, then you will not be able to avoid this problem, because it's part of the (client-side) spec:

如果UA支持HTTP身份验证[RFC2617]，它应该考虑来自此对象的请求
是保护空间的一部分包括
访问的URI并发送授权标头并适当处理401个未授权请求
。如果验证失败，UA应该提示用户提供凭证。

If the UA supports HTTP Authentication [RFC2617] it SHOULD consider requests originating from this object to be part of the protection space that includes the accessed URIs and send Authorization headers and handle 401 Unauthorised requests appropriately. if authentication fails, UAs should prompt the users for credentials.

因此规范实际上要求浏览器相应地提示用户在XMLHttpRequest中收到401响应，就像用户直接访问了URL一样。据我所知，据我所知，真正避免这种情况的唯一方法就是让你控制服务器端并避免401 Unauthorized响应。

So the spec actually calls for the browser to prompt the user accordingly if any 401 response is received in an XMLHttpRequest, just as if the user had accessed the URL directly. As far as I can tell the only way to really avoid this would be for you to have control over the server side and cause 401 Unauthorized responses to be avoided, as Mark mentioned.

最后一个想法是，你可以使用代理来解决这个问题，在另一个网络服务器上使用这样一个单独的服务器端脚本。该脚本然后接受用户并传递参数并检查身份验证，以便用户的浏览器不是原始HTTP请求的原因，因此没有收到导致提示的401响应。如果以这种方式执行此操作，则可以从代理脚本中找到它是否失败，如果是，则再次提示用户，直到成功为止。在成功的身份验证事件中，您可以像现在一样简单地获取HTTP请求，因为如果正确指定了凭据，一切都会正常工作。

One last thought is that you may be able to get around this using a proxy, such a separate server side script on another webserver. That script then takes a user and pass parameter and checks the authentication, so that the user's browser isn't what's making the original HTTP request and therefore isn't receiving the 401 response that's causing the prompt. If you do it this way you can find out from your "proxy" script if it failed, and if so then prompt the user again until it succeeds. On a successful authentication event, you can simply fetch the HTTP request as you are now, since everything works if the credentials are correctly specified.

这篇关于在未经授权的请求后禁止NTLM对话框的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！