Share via

3.1.1.2 NTLM Software Interaction

  • Article

During the inside_authentication phase, the NNTP client invokes the NTLM software, as described in [MS-NLMP] section 3.1. The NTLM Authentication Protocol is used with these options:

  1. The negotiation is a connection-oriented NTLM negotiation.

  2. None of the flags that are specified in [MS-NLMP] section 3.1.1 are passed to NTLM.

The following describes how NNTP uses NTLM. Remember that all NTLM messages are encapsulated as in section 2.2. The NTLM Authentication Protocol, as specified in [MS-NLMP] section 3.1.1, describes the data model, internal states, and sequencing of NTLM messages in greater detail:

  1. The client initiates the authentication by invoking NTLM. NTLM then returns the NTLM NEGOTIATE_MESSAGE to be sent by the client to the server.

  2. Subsequently, the exchange of NTLM messages continues as defined by the NTLM Authentication Protocol: The NNTP client encapsulates the NTLM messages before sending them to the server and de-encapsulates NNTP messages to obtain the NTLM message, before giving it to NTLM.

  3. The NTLM Authentication Protocol completes authentication, either successfully or unsuccessfully, as follows:

    • The server sends the NNTP_AUTH_NTLM_Succeeded_Response to the client. After receiving this message, the client transitions to the completed_authentication state and treats the authentication attempt as successful.

    • The server sends the NNTP_AUTH_Fail_Response to the client. After receiving this message, the client transitions to the completed_authentication state and treats the authentication attempt as failed.

    • The server sends the NNTP_AUTH_Other_Failure_Response to the client. After receiving this message, the client transitions to the completed_authentication state and treats the authentication attempt as failed.

    • Failures reported from the NTLM software (which can occur for any reason, including incorrect data being passed in or implementation-specific errors), might be reported to the client by NTLM and cause the client to transition to the completed_authentication state.