hc-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Oleg Kalnichevski <ol...@apache.org>
Subject Re: NTLMv2 in Apache HttpClient
Date Sun, 02 Mar 2008 20:12:49 GMT

On Sun, 2008-03-02 at 09:16 +0100, Roland Weber wrote: 
> Hi Cathy, Oleg,
> 
> please apologize my dropping a bit of salt into the soup.
> 
> Oleg Kalnichevski wrote:
> > On Wed, 2008-02-27 at 15:18 -0800, ckegley@us.ibm.com wrote:
> >> Hi Oleg,
> >>
> > 
> > Hi Cathy
> > 
> >> I am investigating what it would take to add NTLMv2 support to the Apache
> >> HttpClient as well as integrated Windows authentication for both NTLMv1
> >> and v2.  I have seen your name on numerous messages in the forum
> >> regarding NTLM, so thought I write you.  Is this support something you
> >> would be interested to see contributed back to the HttpClient?  What are
> >> the restrictions on this?
> > 
> > Absolutely. We would love to see a better support for NTLMv2 in
> > HttpClient.
> 
> Yes, we would love to see better support for NTLMv2 in HttpClient.
> But what we would not want to see is somebody dropping a huge block
> of code on us without giving further support. There will be user
> questions on how things work or why they don't, and there will be
> bugs that need fixing. 

Roland

Not that we are able to properly maintain the existing NTLM code either.
A better and cleaner NTLM implementation would be still be a big step
forward.

> Will there also be developers staying with
> the code to answer those questions and fix those bugs?
> As far as I can tell, the OSS expertise around NTLM currently resides
> at Samba/jCIFS. That's why our thoughts revolved around using jCIFS:
> we wouldn't need to become NTLM experts ourselves.
> 

We have been waiting several years for an approval to depend on LGPL
libraries. How long do you suggest we should wait?

> If the idea is to create a self-sustaining subproject for NTLM, I'm
> all for it. But that means Incubator, not a code donation to us.

The purpose of incubation is to form a community around a code base. The
scope of NTLM is too narrow to expect a self-sustaining community to
form around it. So what is the point of incubating that piece code in
the first place? 

> A question that remains is whether it makes sense to duplicate
> the efforts of the Samba team at Apache.
> 

The scope of jCIFS is _significantly_ broader than just NTLM stuff.
NTLMv1 code in HttpClient 3.1 is just a _single_ class. Even if split
that code into a number of smaller classes it would still be nowhere
close to jCIFS.

Oleg


> cheers,
>    Roland
> 
> [1] 
> http://mail-archives.apache.org/mod_mbox/incubator-general/200802.mbox/%3c47A744CD.2030705@wstoddard.com%3e
> [2] http://www.apache.org/foundation/how-it-works.html#management
> [3] 
> http://incubator.apache.org/incubation/Incubation_Policy.html#Graduating+from+the+Incubator
> 
> 
> 
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
> For additional commands, e-mail: dev-help@hc.apache.org
> 
> 


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
For additional commands, e-mail: dev-help@hc.apache.org


Mime
View raw message