HTTP NTLM 身份验证

Question

我正在尝试使用需要 NTLM 身份验证的 API。此 curl 命令工作正常:

curl -X POST --header 'Content-Type: application/json' --header 'Accept: application/json'  --ntlm -u user:password -d '{ "key1": "100",     "key2": "1"}' http://some/api/v/12

现在我正尝试通过 Go 程序执行相同的操作:

package main

import (
    "bytes"
    "fmt"
    "net/url"
    "net/http"
    "io/ioutil"
    "log"
    "github.com/Azure/go-ntlmssp"



)

func main() {
    url_ := "http://some/api/v/12"

     client := &http.Client{
        Transport: ntlmssp.Negotiator{
            RoundTripper:&http.Transport{},
        },
    }



    data := url.Values{}
    data.Set("key1", "100")
    data.Set("key2", "1")
    b := bytes.NewBufferString(data.Encode())
    req, err := http.NewRequest("POST", url_,  b)
    req.Header.Set("Content-Type", "application/json")
    req.Header.Set("Accept", "application/json")
    req.SetBasicAuth("user", "password")


    resp, err := client.Do(req)
    if err != nil {
        fmt.Printf("Error : %s", err)
    } else {

        responseData, err := ioutil.ReadAll(resp.Body)
        if err != nil {
            log.Fatal(err)
        }


        responseString := string(responseData)



        fmt.Println(responseString)
        resp.Body.Close()
    }

}

当我执行这个程序时，我收到一个“无效的凭据”错误，当我在 curl 命令中不包含“--ntlm”标志时，我通常会收到这个错误。

你能给我一个提示，告诉我如何用 Go 完成这个任务吗？

---

更新

打印来自 curl 命令的请求:

* About to connect() to www.xxx.xxx.com port xx (#0)
*   Trying xxx.xxx.x.xxx...
* Connected to www.xxx.xxx.com (xxx.xxx.x.xx) port xx (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
* Server auth using NTLM with user 'user'


> POST /some/api/v2 HTTP/1.1
> Authorization: NTLM xxxxx (44 cahracters)
> User-Agent: curl/7.29.0
> Host: www.xxx.xxx.com
> Content-Type: application/json
> Accept: application/json
> Content-Length: 0
>

< HTTP/1.1 401 Unauthorized
< Content-Type: text/html; charset=us-ascii
< Server: Microsoft-HTTPAPI/2.0
< WWW-Authenticate: NTLM xxxxx (312 characters) 
< Date: Thu, xx Aug xxxx xx:xx:xx xxx
< Content-Length: 341
<

* Ignoring the response-body
* Connection
* Issue another request to this URL: 'http://some/api/v2'
* Found bundle for host www.xxx.xxx.com: 0x0000
* Re-using existing connection! 
* Connected to www.xxx.xxx.com (xxx.xxx.x.xx) port xx (#0)
* Server auth using NTLM with user 'user'
> POST /api/v2 HTTP/1.1
> Authorization: NTLM xxx (176 characters)
> User-Agent: curl/7.29.0
> Host: www.xxx.xxx.com
> Content-Type: application/json
> Accept: application/json
> Content-Length: 39
>


* upload completely sent off: 39 out of 39 bytes


< HTTP/1.1 200 OK
< Cache-Control: no-cache
< Pragma: no-cache
< Content-Type: application/json; charset=utf-8
< Expires: -1
< Server: Microsoft-IIS/7.5
< X-AspNet-Version: 4.0.30319
< Persistent-Auth: true
< X-Powered-By: ASP.NET
< Date: Thu, 08 Aug 2019 06:49:41 GMT
< Content-Length: 1235

Answer 1

NTLM 需要完全限定的域\用户名登录。电子邮件或简单的用户名不起作用。所以对于用户名部分，它必须看起来像这样:

我的域名\[用户名]

其中 [用户名] 是实际的 Windows 用户。