Devolutions / Devolutions/sspi-rs

NTLM Server CompleteNeeded being returned after Authentication message

Open
#167 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Rust
Stars
83
Forks
50
Avg merge
3d 12h
Merged PRs (30d)
9

Description

The NTLM acceptor is returning `CompleteNeeded` after processing the authentication message from the initiator

https://github.com/Devolutions/sspi-rs/blob/1f71235bad5f56f22b0d31600a5cebd9db21c3ec/src/ntlm/messages/server/authenticate.rs#L52

This is different from SSPI actual which just returned `SEC_E_OK`. It seems like `CompleteAuthToken` has been implemented to finalise the security context but this should just work like SSPI actual and be done when processing the authentication message

https://github.com/Devolutions/sspi-rs/blob/1f71235bad5f56f22b0d31600a5cebd9db21c3ec/src/ntlm/messages/server/complete_authenticate.rs#L7

The [CompleteAuthToken](https://learn.microsoft.com/en-us/windows/win32/api/sspi/nf-sspi-completeauthtoken) notes even states it is only for the Digest sec provider

> This function is supported only by the Digest [security support provider](https://learn.microsoft.com/en-us/windows/desktop/SecGloss/s-gly) (SSP).

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.