Remove NTLM authentication
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 133
- Forks
- 205
- Avg merge
- 16h 3m
- Merged PRs (30d)
- 102
Description
### Problem Description
2 connectors support only NTLM authentication (Sharepoint Server and Network Drive). NTLM authentication is deprecated and non compliant with FIPS.
### Proposed Solution
Add a breaking change to only support kerberos authentication for these connectors and any future connectors that have the option for NTLM
### Alternatives
none
### Additional Context
This was highlighted in achieving FIPS compliance for connectors. We had to disable these 2 connectors as it is impossible to use FIPS approved algorithms has the problem is not because of the library but because of the protocol itself.
Here is the [link from Microsoft](https://learn.microsoft.com/en-us/windows/whats-new/deprecated-features) showing NTLM is deprecated.
Below is snippet from the link:
"All versions of [NTLM](https://learn.microsoft.com/en-us/windows/win32/secauthn/microsoft-ntlm), including LANMAN, NTLMv1, and NTLMv2, are no longer under active feature development and are deprecated.
Use of NTLM will continue to work in the next release of Windows Server and the next annual release of Windows.
Calls to NTLM should be replaced by calls to Negotiate, which tries to authenticate with Kerberos and only falls back to NTLM when necessary.
For more information, see, [Resources for deprecated features](https://learn.microsoft.com/en-us/windows/whats-new/deprecated-features-resources).
[Update - November 2024]: NTLMv1 is [removed](https://learn.microsoft.com/en-us/windows/whats-new/removed-features) starting in Windows 11, version 24H2 and Windows Server 2025."
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing the Sharepoint Server and Network Drive connectors and their NTLM authentication options. Review how authentication is configured in both connectors, then determine the breaking-change and migration implications of limiting them to Kerberos; done means the proposed scope is implemented consistently for these connectors and future connectors with the same option.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- authentication, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100