从 Java 使用 SharePoint Web 服务时 NTLM 失败？
我有一个 Java 客户端，它使用使用 JDK 6 中的 JAX-WS 实现编写的 SharePoint 2010 标准 Web 服务（sitedata.asmx、permissions.asmx 等）。
到目前为止，身份验证是使用自定义 Authenticator< 通过 NTLM 完成的/code> 实现和 Authenticator.setDefault(...) 方法。
当在只有一台 SharePoint 服务器的测试环境上运行时，它工作正常。我可以使用 WireShark 查看所有 NTLM 协商。
但是，如果在具有多个服务器、硬件负载平衡和多个 SharePoint 备用访问映射的客户上运行，我会收到来自 Web 服务调用的错误 401 未经授权。我还没有机会使用 WireShark 在该环境上进行调试。
我从 Windows 计算机（在客户设置上）运行我的客户端，因此根据 Java 文档，它对于 NTLM 来说应该没问题。另外，我使用 SharePoint 中的默认 URL 来访问 Web 服务（而不是负载平衡 URL）。
运行客户端应用程序的计算机不是 SharePoint 服务器。它具有配置了 NTLM 的 Windows 集成身份验证。
此外，由于 SharePoint 管理策略，我无法访问 SharePoint 管理中心或对配置（或 IIS）进行任何更改。
我想请问有人知道可能是什么问题吗？希望有人知道如何解决它吗？
提前致谢。
编辑：
值得一提的是，这两种环境都授予了相同的权限级别。
I have a Java client that consumes SharePoint 2010 standard web services (sitedata.asmx, permissions.asmx, etc) written with JAX-WS implementation from the JDK 6.
So far, authentication is done with NTLM using a custom Authenticator implementation and Authenticator.setDefault(...) approach.
When running on my test environment which has only one SharePoint server, it works fine. I can see all the NTLM negotiation using WireShark.
But, if running on a costumer which has multiple servers, hardware load balancing and multiple SharePoint alternate access mappings I get Error 401 Unauthorized from the web service calls. I haven't had a chance to use WireShark to debug on that environment.
I run my client from a Windows machine (on the costumer setup), so according to Java documentation it should be fine for NTLM. Also, I used the default URL from SharePoint to access the web services (not the load balanced URLs).
The machine running the client application, is not a SharePoint server. It has Windows Integrated Authentication with NTLM configured.
Also, due SharePoint administration policies, I´m unable to access SharePoint Central Administration or do any change to the configuration (nor IIS).
I want to ask if anyone knows what the issue may be? And hopefully if anyone knows how to fix it?
Thanks in advance.
EDIT:
It´s important to mention, that the same permission levels were granted on both environments.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
好吧，我终于有机会在客户环境中使用 WireShark。
首先我注意到他们配置了 NTLM v2，但这没关系，因为 Java 1.6 支持它。
然后我看到，由于启用了 Windows 集成身份验证，因此将发送当前登录的用户凭据，而不是代码上配置的凭据。由于登录的用户没有 SharePoint 权限，因此我收到 401 未经授权。
根据 Java 文档 这是正常行为
我希望有人可以回答这个问题< /a> 因为我认为这正是我所需要的。
最后，我观察到，对于 HTTP，将首先尝试 Windows 凭据，如果失败，将使用代码提供的凭据。因此，一切正常。
使用 HTTPS 时，只会使用 Windows 凭据，因此我总是收到 401 Unauthorized。
不确定 HTTP 和 HTTPS 之间的差异是什么原因造成的。
Well, finally I had a chance to use WireShark on the costumer environment.
First I noticed they have NTLM v2 configured, but that's OK since Java 1.6 supports it.
Then I saw that since Windows Integrated Authentication is enabled, the current logged user credentials are sent instead of the ones configured on the code. Since logged user has no permissions on SharePoint, I received 401 Unauthorized.
According to Java documentation this is the normal behavior
I hope someone can answer this question since I think that's exactly what I need.
Finally, I observed that with HTTP first Windows credentials will be tried, and on failure the credentials provided by the code will be used instead. Thus, everything works fine.
When using HTTPS, only Windows credentials will be used, so I always got 401 Unauthorized.
Not sure what the causes the difference between HTTP and HTTPS.
您必须禁用 java 中的透明身份验证。您可以通过放入自定义 rt.jar 或使用反射来修改 java 类来完成此操作。
tryTransparentNTLMServer 和 tryTransparentNTLMProxy 是 HttpURLConnection 中的字段，您需要将其设置为accessible，然后在使用反射方法时设置为 false。显然，如果您制作自己的 rt.jar，只需更改此类
You have to disable the tranparent authentication in java. you can do this either by dropping in a custom rt.jar or using reflection to modify the java classes.
tryTransparentNTLMServer and tryTransparentNTLMProxy are the fields in the HttpURLConnection which you need to set accessible and then to false when using the reflection method. Obviously just change this class if your making your own rt.jar