Mailing-List: contact httpclient-users-help@hc.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "HttpClient User Discussion" <httpclient-users@hc.apache.org>
Received-SPF: pass (athena.apache.org: domain of kfung4cxf@gmail.com
 designates 209.85.213.41 as permitted sender)
MIME-Version: 1.0
From: K Fung <kfung4cxf@gmail.com>
Date: Wed, 13 Aug 2014 13:55:32 -0700
Message-ID: 
 <CA+MNT+y908e3uH6Y5tHYjDBk3ocK-ZKhfcgW-dVC_DF3nv+67A@mail.gmail.com>
Subject: Supporting delegated credentials (ISC_REQ_DELEGATE) via ClientWinAuth
 in HttpClient 4.4
To: httpclient-users@hc.apache.org
Content-Type: text/plain; charset=UTF-8

Hello,

In WindowsNegotiateScheme.getToken(), would it be possible to change
Sspi.ISC_REQ_CONNECTION to Sspi.ISC_REQ_CONNECTION |
Sspi.ISC_REQ_DELEGATE? Would it be accepted as a bug?

If you use this Wikipedia graphic as a reference,
http://en.wikipedia.org/wiki/Kerberos_(protocol)#mediaviewer/File:Kerberos.svg,
the current implementation in HttpClient 4.4alpha1 does the first
(red) and last (green) steps but it doesn't do the middle one
(middle). By adding this parameter, it won't skip out on the middle
step (where the Windows LSA will ask the Windows domain controller to
generate a ticket-granting-ticket for the requested service).

Regards,
kl

---------------------------------------------------------------------
To unsubscribe, e-mail: httpclient-users-unsubscribe@hc.apache.org
For additional commands, e-mail: httpclient-users-help@hc.apache.org