HttpClient 4.3.6 返回“警告：协商身份验证错误”

Question

我在 Java 6 中运行 HttpClient 4.3.6。当我运行以下代码时，身份验证似乎成功。返回的状态码是 200。但是，我在控制台中收到以下错误消息：

警告：NEGOTIATE 验证错误：提供的名称无效（机制级别：无法加载配置文件 C:\Windows\krb5.ini（系统找不到指定的文件））

如何消除此警告？

CloseableHttpClient httpclient = HttpClients.createDefault();
HttpContext localContext = new BasicHttpContext();
HttpGet method = new HttpGet(url);
CredentialsProvider credsProvider = new BasicCredentialsProvider();
credsProvider.setCredentials(
   new AuthScope(host, 80),
   new NTCredentials(userid, password, host, login_domain));

localContext.setAttribute(HttpClientContext.CREDS_PROVIDER, credsProvider);

String filePath = null;

// Execute the method.
CloseableHttpResponse clientResponse = httpclient.execute(method, localContext);

HttpEntity entity = clientResponse.getEntity();

int statusCode = clientResponse.getStatusLine().getStatusCode();

if (statusCode != HttpStatus.SC_OK) {
   System.err.println("Method failed: " + method.getRequestLine());
}

Answer 1

你需要传入一组目标首选认证方案：

像这样创建你的 httpClient：

PoolingHttpClientConnectionManager connPool = new PoolingHttpClientConnectionManager();

connPool.setMaxTotal(200);
connPool.setDefaultMaxPerRoute(200);

// Authentication
CredentialsProvider credsProvider = new BasicCredentialsProvider();
credsProvider.setCredentials(AuthScope.ANY, new NTCredentials(username, password, workstation, domain));


RequestConfig config = RequestConfig.custom().setTargetPreferredAuthSchemes(Arrays.asList(AuthSchemes.NTLM)).build();

CloseableHttpClient httpClient = HttpClients.custom().setConnectionManager(connPool).setDefaultRequestConfig(config).build();

HttpClientContext context = HttpClientContext.create();
context.setCredentialsProvider(credsProvider);      

Answer 2

是的，我相信，事实上，您的身份验证是成功的，并且可能只是从 Kerberos 退回到 NTLM。我的代码看起来与您的相似，在我的应用程序中，我使用 Java 7 中的 HttpClient 4.3.5 连接到 SharePoint。当 SharePoint 配置为“协商”（尝试 Kerberos，然后故障转移到 NTLM）时，我会看到类似的错误您在 HttpClient 生成的日志中报告的内容，具体而言：

Selected authentication options: [NEGOTIATE, NTLM] Executing request GET /my/personal/user2/_api/web?$select=ServerRelativeUrl HTTP/1.1 Target auth state: CHALLENGED Generating response to an authentication challenge using Negotiate scheme init XXX.XXX.XXX.XXX:80 NEGOTIATE authentication error: org.ietf.jgss.GSSException, major code: 11, minor code: 0 major string: General failure, unspecified at GSSAPI level minor string: Desired initLifetime zero or less Generating response to an authentication challenge using ntlm scheme

之后，它将通过 NTLM 成功进行身份验证。因此，我读到该错误消息说“Kerberos 不起作用，现在我们将使用 NTLM”。只要您收到 200 条响应，就可以开始了。

Answer 3

您确定身份验证成功进行吗，如果网站设置为协商（尝试 Kerbero，然后故障转移到 NTLM）基本身份验证可能不会成功。