Bug 215920 – [GTK] Webkitgtk does not support NTLM Authentication and does not show auth dialog

• Component: WebKitGTK
• Status: RESOLVED DUPLICATE

I am using webkitgtk container to display web page.However some pages require authentication and show javascript dialogs for authentication.How to handle it in webkitgtk? I have tried setting the properties allow-modal-dialogs to true and javascript-can-open-windows-automatically to true
However I am not seeing any dialogs which asks for authentication
Is there default popup handler in webkitgtk?
If not should we implement it by connecting to authenticate signal?

[Michael Catanzaro]

You can connect to WebKitWebView::authenticate to handle the authentication, but by default it should show a dialog that works, so you don't *need* to do that.

If that's not working for some reason on some particular site, or in your setup, then more info is needed. You can test to see if the default implementation works using MiniBrowser, which does not handle the WebKitWebView::authenticate signal.

Where can I get MiniBrowser? Can you share it? I will try that.Mainly IWA popups are not being shown

(In reply to Michael Catanzaro from comment #1)
> You can connect to WebKitWebView::authenticate to handle the authentication,
> but by default it should show a dialog that works, so you don't *need* to do
> that.
> 
> If that's not working for some reason on some particular site, or in your
> setup, then more info is needed. You can test to see if the default
> implementation works using MiniBrowser, which does not handle the
> WebKitWebView::authenticate signal.

I checked in MiniBrowser when I navigate to the site which shows IWA popup  or NTLM dialog for authentication it displays this error
401 - Unauthorized: Access is denied due to invalid credentials.
You do not have permission to view this directory or page using the credentials that you supplied.

Created attachment 407470 [details]
Attachment for popup not shown with webkitgtk

I have attached the popup which is being not shown with webkitgtk but works with all other browsers

[Michael Catanzaro]

That doesn't look like HTTP authentication. That looks like a custom authentication page. That could be a web content issue. E.g. they could simply not send the authentication page at all if user agent doesn't contain "Firefox" or "Chrome". Who knows what's going on there, but I doubt it indicates a problem with HTTP authentication.

(In reply to Michael Catanzaro from comment #5)
> That doesn't look like HTTP authentication. That looks like a custom
> authentication page. That could be a web content issue. E.g. they could
> simply not send the authentication page at all if user agent doesn't contain
> "Firefox" or "Chrome". Who knows what's going on there, but I doubt it
> indicates a problem with HTTP authentication.

I think the issue is mainly with IWA (Integrated Windows Authentication). It does not show IWA Auth prompt

(In reply to Michael Catanzaro from comment #5)
> That doesn't look like HTTP authentication. That looks like a custom
> authentication page. That could be a web content issue. E.g. they could
> simply not send the authentication page at all if user agent doesn't contain
> "Firefox" or "Chrome". Who knows what's going on there, but I doubt it
> indicates a problem with HTTP authentic(In reply to Michael Catanzaro from comment #5)
> That doesn't look like HTTP authentication. That looks like a custom
> authentication page. That could be a web content issue. E.g. they could
> simply not send the authentication page at all if user agent doesn't contain
> "Firefox" or "Chrome". Who knows what's going on there, but I doubt it
> indicates a problem with HTTP authentication.

Should I collect any logs here?

(In reply to Michael Catanzaro from comment #5)
> That doesn't look like HTTP authentication. That looks like a custom
> authentication page. That could be a web content issue. E.g. they could
> simply not send the authentication page at all if user agent doesn't contain
> "Firefox" or "Chrome". Who knows what's going on there, but I doubt it
> indicates a problem with HTTP authentication.

I see www-authenticate header for this sites is ntlm

(In reply to Michael Catanzaro from comment #5)
> That doesn't look like HTTP authentication. That looks like a custom
> authentication page. That could be a web content issue. E.g. they could
> simply not send the authentication page at all if user agent doesn't contain
> "Firefox" or "Chrome". Who knows what's going on there, but I doubt it
> indicates a problem with HTTP authentication.

In addition basic authentication works ,the problem looks like only with NTLM

(In reply to Michael Catanzaro from comment #5)
> That doesn't look like HTTP authentication. That looks like a custom
> authentication page. That could be a web content issue. E.g. they could
> simply not send the authentication page at all if user agent doesn't contain
> "Firefox" or "Chrome". Who knows what's going on there, but I doubt it
> indicates a problem with HTTP authentication.

Is there any configuration to enable NTLM authentication?

[Michael Catanzaro]

No, NTLM is supported by via gssapi, see bug #122952. That doesn't require any configuration.

I suspect hardly anybody ever tests it, so it's possible it could be broken.

(In reply to Michael Catanzaro from comment #11)
> No, NTLM is supported by via gssapi, see bug #122952. That doesn't require
> any configuration.
> 
> I suspect hardly anybody ever tests it, so it's possible it could be broken.

Does it work via authenticate signal as well? Is there any working sample of implementing NTLM dialog via authenticate signal

[Michael Catanzaro]

(In reply to srinivasnakshathri from comment #12)
> Does it work via authenticate signal as well?

It should.

> Is there any working sample of
> implementing NTLM dialog via authenticate signal

Nothing special about NTLM here. You don't need to override authenticate unless you want to use a custom dialog, in which case you can do whatever you want to construct the dialog.

(In reply to Michael Catanzaro from comment #13)
> (In reply to srinivasnakshathri from comment #12)
> > Does it work via authenticate signal as well?
> 
> It should.
> 
> > Is there any working sample of
> > implementing NTLM dialog via authenticate signal
> 
> Nothing special about NTLM here. You don't need to override authenticate
> unless you want to use a custom dialog, in which case you can do whatever
> you want to construct the dialog.


Hi can you help in giving sample project to refer? As per this article which is quite old even implementing authenticate signal is not enough to catch NTLM
https://webkit-gtk.webkit.narkive.com/XksdiPTi/webkit-gtk-memory-leak

[Michael Catanzaro]

That post is very old and predates libsoup's support for gssapi.

Again, it should work by default. You don't need to implement any signal. If it doesn't work, then there's a bug, but you haven't shown us any website where it's broken yet. I don't know of any websites that use NTLM authentication, so I don't know how we would test it.

Also, can you set a title for this bug please? It's unlikely to get much attention in the future without a proper title.

(In reply to Michael Catanzaro from comment #15)
> That post is very old and predates libsoup's support for gssapi.
> 
> Again, it should work by default. You don't need to implement any signal. If
> it doesn't work, then there's a bug, but you haven't shown us any website
> where it's broken yet. I don't know of any websites that use NTLM
> authentication, so I don't know how we would test it.
> 
> Also, can you set a title for this bug please? It's unlikely to get much
> attention in the future without a proper title.

Hi I have tried multiple internal websites which uses NTLM Authentication with MiniBrowser,none of them show auth dialog and redirects successfully. I am not sure how to get external websites which uses NTLM Authentication 

How do I set title for the bug?

(In reply to Michael Catanzaro from comment #15)
> That post is very old and predates libsoup's support for gssapi.
> 
> Again, it should work by default. You don't need to implement any signal. If
> it doesn't work, then there's a bug, but you haven't shown us any website
> where it's broken yet. I don't know of any websites that use NTLM
> authentication, so I don't know how we would test it.
> 
> Also, can you set a title for this bug please? It's unlikely to get much
> attention in the future without a proper title.

I managed to get external website http://ntlm.herokuapp.com/ ,I am able to repro the issue,and not able to get NTLM Auth dialog.But this works with all other browsers

[Michael Catanzaro]

OK, good job finding a test page and also for finding bug #122952. Let's continue in bug #122952 since there's more relevant discussion there.

*** This bug has been marked as a duplicate of bug 122952 ***

(In reply to Michael Catanzaro from comment #18)
> OK, good job finding a test page and also for finding bug #122952. Let's
> continue in bug #122952 since there's more relevant discussion there.
> 
> *** This bug has been marked as a duplicate of bug 122952 ***

No problem,is there any intermediate solution for this?