Mailing-List: contact httpclient-users-help@hc.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "HttpClient User Discussion" <httpclient-users@hc.apache.org>
Received-SPF: pass (athena.apache.org: domain of sabarivasan@gmail.com
 designates 209.85.146.177 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=message-id:date:from:to:subject:in-reply-to:mime-version
         :content-type:references;
        b=e1xD0y5vjDyYxzOGN5vhN74O0SwXsbi1WlglwGIvmHBwcSMrpGK8Y1C32hd0jl69pS
         sQrFL5Dgu6ok3V7+Ge4aDX6UJ4r8t8tvBoB4iD8asKnV4y0T4Vi1VVh7JZ2ekLe3knkR
         Avy0KgOqbQdEezgZabGVBR9jnJi+Foe5B9QV8=
Message-ID: <d6d4ea820807290844n3bcb4b7dr16cfc9b7e14ce037@mail.gmail.com>
Date: Tue, 29 Jul 2008 08:44:03 -0700
From: "Sabarivasan Viswanathan" <sabarivasan@gmail.com>
To: "HttpClient User Discussion" <httpclient-users@hc.apache.org>
Subject: Re: Problem disabling BASIC authentication
In-Reply-To: <488F09C1.8020701@apache.org>
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary="----=_Part_33004_14553089.1217346243962"
References: <d6d4ea820807281631n2191c199uf38d96a39c1cd404@mail.gmail.com>
	 <488F09C1.8020701@apache.org>

------=_Part_33004_14553089.1217346243962
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

Thanks as always to a prompt response that answers all my questions.

Sabari

On Tue, Jul 29, 2008 at 5:14 AM, Oleg Kalnichevski <olegk@apache.org> wrote:

> Sabarivasan Viswanathan wrote:
>
>> Hello,
>>
>> I am having trouble disabling every scheme except DIGEST and sending
>> credentials preemptively.
>>
>> What I see when I use Wireshark is that the first HTTP request sends
>> credentials in BASIC mode. The server sends a 401 challenge after which
>> the
>> client sends the correct DIGEST credentials. For obvious security reasons,
>> I
>> want to avoid sending credentials in clear text using BASIC
>> authentication.
>>
>> If possible, I would also like to avoid the challenge step and use
>> preemptive authentication so that only 1 round trip is needed.
>>
>> Here is my code:
>>        HttpClient client = new HttpClient();
>>
>>        client.getState().setCredentials(new AuthScope("host", 80,
>> "securearea"),
>>                                         new
>> UsernamePasswordCredentials("username", "password");
>>
>>        List authPrefs = new ArrayList(1);
>>        authPrefs.add(AuthPolicy.DIGEST);
>>        client.getParams().setParameter(AuthPolicy.AUTH_SCHEME_PRIORITY,
>> authPrefs);
>>
>>        client.getParams().setAuthenticationPreemptive(true);
>>
>>        PostMethod post = new PostMethod("http://host/resource");
>>        post.setDoAuthentication(true);
>>
>>        int result = client.executeMethod(post);
>> ....
>>
>> I have noticed that if I uncomment the line that does
>> setAuthenticationPreemptive(true), the first request does not send any
>> credentials at all and the 2nd request uses DIGEST credentials
>> appropriately.
>>
>> Is there anything I am missing?
>>
>> Sabari
>>
>>
>>
> Sabarivasan,
>
> HttpClient 3.x can only authenticate preemptively using BASIC scheme.
> HttpClient 4.0 can optionally store the DIGEST challenge in the execution
> context and use it for preemptive authentication:
>
>
> http://svn.apache.org/repos/asf/httpcomponents/httpclient/trunk/module-client/src/examples/org/apache/http/examples/client/ClientPreemptiveDigestAuthentication.java
>
> Preemptive authentication of any kind is generally discouraged, though.
>
> Oleg
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: httpclient-users-unsubscribe@hc.apache.org
> For additional commands, e-mail: httpclient-users-help@hc.apache.org
>
>

------=_Part_33004_14553089.1217346243962--