2.1.1 HTTP Transport for Binary Group Expansion
The Binary Group Expansion interface uses the HTTP transport ( [RFC1945] and [RFC2616]) to transmit method invocation and return information. The message request of a remote method invocation MUST be sent as part of an HTTP request and the reply from the server MUST be sent as part of the HTTP response.
If instructed by a higher-level protocol in an implementation-specific way, implementations of this protocol MUST require that the HTTP implementation on the server use Basic or Digest Access Authentication for HTTP to authenticate the HTTP client, as specified in [RFC2617] or NTLM authentication [MS-NLMP] for HTTP.
The higher-level protocol MUST provide in an implementation-specific way either credentials in the form of user name/password or a client-side certificate. Implementations of this protocol MUST NOT process the credentials or authentication information. Such processing typically happens entirely inside implementations of lower protocol layers.