278617 – kio_http flooding with "HTTP/1.1 401 Unauthorized" when trying to login to sharepoint websites

Bug 278617 - kio_http flooding with "HTTP/1.1 401 Unauthorized" when trying to login to sharepoint websites

Summary: kio_http flooding with "HTTP/1.1 401 Unauthorized" when trying to login to sh...

Status:	RESOLVED FIXED

Alias:	None

Product:	kio
Classification:	Frameworks and Libraries
Component:	http (show other bugs)
Version:	SVN
Platform:	Compiled Sources Linux

Importance:	NOR normal
Target Milestone:	---
Assignee:	kdelibs bugs

URL:
Keywords:

Depends on:
Blocks:

Reported:	2011-07-27 11:39 UTC by LuRan
Modified:	2011-08-20 07:34 UTC (History)
CC List:	1 user (show)

See Also:
Latest Commit:
Version Fixed In:	4.7.1

Attachments
Add an attachment

Note You need to log in before you can comment on or make changes to this bug.

Description LuRan 2011-07-27 11:39:13 UTC

Version:           SVN (using Devel) 
OS:                Linux

when I tried to login to espace.cern.ch, konqueror poped up a authenticate dialog and nothing happened after I type in username and password, I add enabled debug info in kio_http and the following message appears thousands of time:

kio_http(9380) HTTPProtocol::sendQuery: ============ Sending Header:
kio_http(9380) HTTPProtocol::sendQuery: "GET /_layouts/Authenticate.aspx?Source=%2Fdefault%2Easpx HTTP/1.1"
kio_http(9380) HTTPProtocol::sendQuery: "Host: espace.cern.ch"
kio_http(9380) HTTPProtocol::sendQuery: "Connection: Keep-Alive"
kio_http(9380) HTTPProtocol::sendQuery: "User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; zh-CN) AppleWebKit/533.3 (KHTML, like Gecko) konqueror/4.7.40 Safari/533.3"
kio_http(9380) HTTPProtocol::sendQuery: "Referer: https://espace.cern.ch/default.aspx"
kio_http(9380) HTTPProtocol::sendQuery: "Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
kio_http(9380) HTTPProtocol::sendQuery: "Accept-Encoding: gzip, deflate, x-gzip, x-deflate"
kio_http(9380) HTTPProtocol::sendQuery: "Accept-Charset: utf-8,*;q=0.5"
kio_http(9380) HTTPProtocol::sendQuery: "Accept-Language: zh-CN,en-US;q=0.9,en;q=0.8"
kio_http(9380) HTTPProtocol::sendQuery: "Cookie: AI_SESSION=3CAA9345932FDE2696654849B9035AD822E617DED678C37A25455E7C5D4D7782C04F213835EEBA91C07825F7E20196D60A3D6E45CDA0760835D07062C12C51EBF50AA04C18DEF246048BFC503E9FAF092310C9D14D3A79B6D3D70EA6C49ABA424F57DEEA"
kio_http(9380) HTTPProtocol::readResponseHeader: ============ Received Status Response:
kio_http(9380) HTTPProtocol::readResponseHeader: "HTTP/1.1 401 Unauthorized"

I tried with another sharepoint website and had the same problem. But both website work well with firefox, or webkit-qt. Rekonq, khtml and webkit-kpart all hang at the kio_http part.

Reproducible: Always

Steps to Reproduce:
Open a sharepoint website
Login with username and password

Actual Results:  
The website loaded normally

Expected Results:  
empty page and kio_http keeps sending request and getting 401 error

I am sorry at this moment I cannot find a publicly available sharepoint website for you to test, I will keep looking, and please let me know if you need more information to debug.

Comment 1 Dawit Alemayehu 2011-07-28 04:49:46 UTC

Can you please include the entire response from the server ? You only provided 

kio_http(9380) HTTPProtocol::readResponseHeader: ============ Received Status Response:
kio_http(9380) HTTPProtocol::readResponseHeader: "HTTP/1.1 401 Unauthorized"

We need the entire reponse and the retry request to see what might be happening. I suspect this is an authentication problem, but cannot be sure without more debug output from the client and the server.

BTW, is it correct that the version of kio_http you are using is compiled from git master ? That is the one that will be included in v4.8 ?

Comment 2 LuRan 2011-07-28 09:05:14 UTC

Here are some outputs from kio_http_debug, I am not sure if it is safe to post the NTLM fragment in the log, so I removed them, I am using git snapshot from yesterday, after your commit (0e0858618df8e3c06b4fc5253485bbe475a1e6b1):
kio_http(10546)/kio_http_debug HTTPProtocol::get: "https://espace.cern.ch/_layouts/Authenticate.aspx?Source=%2Fdefault%2Easpx"
kio_http(10546)/kio_http_debug HTTPProtocol::maybeSetRequestUrl: "https://espace.cern.ch/_layouts/Authenticate.aspx?Source=%2Fdefault%2Easpx"
kio_http(10546)/kio_http_debug HTTPProtocol::resetSessionSettings: Using proxy: false URL: ""
kio_http(10546)/kio_http_debug HTTPProtocol::resetSessionSettings: Window Id = "111149383"
kio_http(10546)/kio_http_debug HTTPProtocol::resetSessionSettings: ssl_was_in_use = "TRUE"
kio_http(10546)/kio_http_debug HTTPProtocol::proceedUntilResponseContent:
kio_http(10546)/kio_http_debug HTTPProtocol::proceedUntilResponseHeader:
kio_http(10546)/kio_http_debug HTTPProtocol::sendQuery:
kio_http(10546)/kio_http_debug HTTPProtocol::satisfyRequestFromCache:
kio_http(10546)/kio_http_debug HTTPProtocol::cacheFileOpenRead:
kio_http(10546)/kio_http_debug HTTPProtocol::cacheFileClose:
kio_http(10546)/kio_http_debug HTTPProtocol::httpShouldCloseConnection: Keep Alive: true
kio_http(10546)/kio_http_debug HTTPProtocol::sendQuery: sent it!
kio_http(10546)/kio_http_debug HTTPProtocol::readResponseHeader:
kio_http(10546)/kio_http_debug HTTPProtocol::readResponseHeader: wasAuthError= false isAuthError= true sameAuthError= false
kio_http(10546)/kio_http_debug HTTPProtocol::readResponseHeader:  -- full response:
"HTTP/1.1 401 Unauthorized^M
Cache-Control: private^M
Content-Length: 16^M
Content-Type: text/html; charset=utf-8^M
Server: Microsoft-IIS/7.5^M
X-AspNet-Version: 2.0.50727^M
WWW-Authenticate: NTLM^M
WWW-Authenticate: Basic realm="espace.cern.ch"^M
X-Powered-By: ASP.NET^M
MicrosoftSharePointTeamServices: 12.0.0.6514^M
Date: Wed, 27 Jul 2011 11:54:10 GMT"
kio_http(10546)/kio_http_debug HTTPProtocol::readResponseHeader: Content-type: "text/html"
kio_http(10546)/kio_http_debug HTTPProtocol::readResponseHeader: Encoding-type: "charset" = "utf-8"
kio_http(10546)/kio_http_debug HTTPProtocol::readResponseHeader: parsing authentication request; response code = 401
kio_http(10546)/kio_http_debug HTTPProtocol::readResponseHeader: pointer to auth class is now 0x231fcc0
kio_http(10546)/kio_http_debug HTTPProtocol::readResponseHeader: Trying authentication scheme: "NTLM"
kio_http(10546)/kio_http_debug HTTPProtocol::readResponseHeader: Auth State: isError= false needCredentials= false forceKeepAlive= false forceDisconnect= false headerFragme nt= "NTLM ****=^M
"
kio_http(10546)/kio_http_debug HTTPProtocol::fixupResponseMimetype: before fixup "text/html"
kio_http(10546)/kio_http_debug HTTPProtocol::fixupResponseMimetype: after fixup "text/html"
kio_http(10546)/kio_http_debug HTTPProtocol::readBody: "16" bytes left.
kio_http(10546)/kio_http_debug HTTPProtocol::readBody: EOD received! Left = "0"
kio_http(10546)/kio_http_debug HTTPProtocol::cacheFileClose:
kio_http(10546)/kio_http_debug HTTPProtocol::cacheFileClose:
kio_http(10546)/kio_http_debug HTTPProtocol::sendQuery:
kio_http(10546)/kio_http_debug HTTPProtocol::satisfyRequestFromCache:
kio_http(10546)/kio_http_debug HTTPProtocol::cacheFileOpenRead:
kio_http(10546)/kio_http_debug HTTPProtocol::cacheFileClose:
kio_http(10546)/kio_http_debug HTTPProtocol::httpShouldCloseConnection: Keep Alive: true
kio_http(10546)/kio_http_debug HTTPProtocol::sendQuery: sent it!
kio_http(10546)/kio_http_debug HTTPProtocol::readResponseHeader:
kio_http(10546)/kio_http_debug HTTPProtocol::readResponseHeader: wasAuthError= true isAuthError= true sameAuthError= true
kio_http(10546)/kio_http_debug HTTPProtocol::readResponseHeader:  -- full response:
"HTTP/1.1 401 Unauthorized^M
Content-Type: text/html; charset=us-ascii^M
Server: Microsoft-HTTPAPI/2.0^M
WWW-Authenticate: NTLM ***=^M
Date: Wed, 27 Jul 2011 11:54:10 GMT^M
Content-Length: 341"
kio_http(10546)/kio_http_debug HTTPProtocol::readResponseHeader: Content-type: "text/html"
kio_http(10546)/kio_http_debug HTTPProtocol::readResponseHeader: Encoding-type: "charset" = "us-ascii"
kio_http(10546)/kio_http_debug HTTPProtocol::readResponseHeader: parsing authentication request; response code = 401
kio_http(10546)/kio_http_debug HTTPProtocol::readResponseHeader: pointer to auth class is now 0x231fcc0
kio_http(10546)/kio_http_debug HTTPProtocol::readResponseHeader: Trying authentication scheme: "NTLM"
kio_http(10546)/kio_http_debug HTTPProtocol::readResponseHeader: Auth State: isError= false needCredentials= true forceKeepAlive= true forceDisconnect= false headerFragment = "NTLM ****=^M
"
kio_http(10546)/kio_http_debug HTTPProtocol::fixupResponseMimetype: before fixup "text/html"
kio_http(10546)/kio_http_debug HTTPProtocol::fixupResponseMimetype: after fixup "text/html"
kio_http(10546)/kio_http_debug HTTPProtocol::readBody: "341" bytes left.
kio_http(10546)/kio_http_debug HTTPProtocol::readBody: EOD received! Left = "0"
kio_http(10546)/kio_http_debug HTTPProtocol::cacheFileClose:
kio_http(10546)/kio_http_debug HTTPProtocol::cacheFileClose:
kio_http(10546)/kio_http_debug HTTPProtocol::sendQuery:
kio_http(10546)/kio_http_debug HTTPProtocol::satisfyRequestFromCache:
kio_http(10546)/kio_http_debug HTTPProtocol::cacheFileOpenRead:
kio_http(10546)/kio_http_debug HTTPProtocol::cacheFileClose:

Comment 3 Dawit Alemayehu 2011-07-29 05:05:54 UTC

On Thu, Jul 28, 2011 at 5:05 AM, LuRan <hephooey_dev@fastmail.fm> wrote:
> https://bugs.kde.org/show_bug.cgi?id=278617
>
>
>
>
>
> --- Comment #2 from LuRan <hephooey_dev fastmail fm>  2011-07-28 09:05:14 ---
> Here are some outputs from kio_http_debug, I am not sure if it is safe to post
> the NTLM fragment in the log, so I removed them, I am using git snapshot from
> yesterday, after your commit (0e0858618df8e3c06b4fc5253485bbe475a1e6b1):

Still not enough information. NTLM authentication is a multi stage
authentication scheme. As such I need more information than the one
you posted. See http://www.innovation.ch/personal/ronald/ntlm.html to
understand the client and server handshake steps. Basically, the
second client response and the server ok or fail debug output is cut
off.

BTW, did you try appending the domain name to your user name to see if
that resolves your problem ? For example, if your domain is "Foo" and
username is "Bar", then you should try to enter "Foo/Bar" into the
username box and see if that fixes your problem.

Comment 4 LuRan 2011-07-29 15:29:53 UTC

The website is very helpful, though the messages I got were not quite the same as described there, here is a complete handshake, (I removed the last base64 NTLM message), I do not really know if there is a domain name for the website so I did not try the domain name trick:

kio_http(10546)/kio_http_debug HTTPProtocol::get: "https://espace.cern.ch/_layouts/Authenticate.aspx?Source=%2Fdefault%2Easpx"
kio_http(10546)/kio_http_debug HTTPProtocol::maybeSetRequestUrl: "https://espace.cern.ch/_layouts/Authenticate.aspx?Source=%2Fdefault%2Easpx"
kio_http(10546)/kio_http_debug HTTPProtocol::resetSessionSettings: Using proxy: false URL: ""
kio_http(10546)/kio_http_debug HTTPProtocol::resetSessionSettings: Window Id = "111149383"
kio_http(10546)/kio_http_debug HTTPProtocol::resetSessionSettings: ssl_was_in_use = "TRUE"
kio_http(10546)/kio_http_debug HTTPProtocol::proceedUntilResponseContent:
kio_http(10546)/kio_http_debug HTTPProtocol::proceedUntilResponseHeader:
kio_http(10546)/kio_http_debug HTTPProtocol::sendQuery:
kio_http(10546)/kio_http_debug HTTPProtocol::satisfyRequestFromCache:
kio_http(10546)/kio_http_debug HTTPProtocol::cacheFileOpenRead:
kio_http(10546)/kio_http_debug HTTPProtocol::cacheFileClose:
kio_http(10546)/kio_http_debug HTTPProtocol::httpShouldCloseConnection: Keep Alive: true
kio_http(10546)/kio_http_debug HTTPProtocol::sendQuery: sent it!
kio_http(10546)/kio_http_debug HTTPProtocol::readResponseHeader:
kio_http(10546)/kio_http_debug HTTPProtocol::readResponseHeader: wasAuthError= false isAuthError= true sameAuthError= false
kio_http(10546)/kio_http_debug HTTPProtocol::readResponseHeader:  -- full response:
"HTTP/1.1 401 Unauthorized
Cache-Control: private
Content-Length: 16
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
WWW-Authenticate: NTLM
WWW-Authenticate: Basic realm="espace.cern.ch"
X-Powered-By: ASP.NET
MicrosoftSharePointTeamServices: 12.0.0.6514
Date: Wed, 27 Jul 2011 11:54:10 GMT"
kio_http(10546)/kio_http_debug HTTPProtocol::readResponseHeader: Content-type: "text/html"
kio_http(10546)/kio_http_debug HTTPProtocol::readResponseHeader: Encoding-type: "charset" = "utf-8"
kio_http(10546)/kio_http_debug HTTPProtocol::readResponseHeader: parsing authentication request; response code = 401
kio_http(10546)/kio_http_debug HTTPProtocol::readResponseHeader: pointer to auth class is now 0x231fcc0
kio_http(10546)/kio_http_debug HTTPProtocol::readResponseHeader: Trying authentication scheme: "NTLM"
kio_http(10546)/kio_http_debug HTTPProtocol::readResponseHeader: Auth State: isError= false needCredentials= false forceKeepAlive= false forceDisconnect= false headerFragment= "NTLM TlRMTVNTUAABAAAABQIAAAAAAAAAAAAAAAAAAAAAAAA=
"
kio_http(10546)/kio_http_debug HTTPProtocol::fixupResponseMimetype: before fixup "text/html"
kio_http(10546)/kio_http_debug HTTPProtocol::fixupResponseMimetype: after fixup "text/html"
kio_http(10546)/kio_http_debug HTTPProtocol::readBody: "16" bytes left.
kio_http(10546)/kio_http_debug HTTPProtocol::readBody: EOD received! Left = "0"
kio_http(10546)/kio_http_debug HTTPProtocol::cacheFileClose:
kio_http(10546)/kio_http_debug HTTPProtocol::cacheFileClose:
kio_http(10546)/kio_http_debug HTTPProtocol::sendQuery:
kio_http(10546)/kio_http_debug HTTPProtocol::satisfyRequestFromCache:
kio_http(10546)/kio_http_debug HTTPProtocol::cacheFileOpenRead:
kio_http(10546)/kio_http_debug HTTPProtocol::cacheFileClose:
kio_http(10546)/kio_http_debug HTTPProtocol::httpShouldCloseConnection: Keep Alive: true
kio_http(10546)/kio_http_debug HTTPProtocol::sendQuery: sent it!
kio_http(10546)/kio_http_debug HTTPProtocol::readResponseHeader:
kio_http(10546)/kio_http_debug HTTPProtocol::readResponseHeader: wasAuthError= true isAuthError= true sameAuthError= true
kio_http(10546)/kio_http_debug HTTPProtocol::readResponseHeader:  -- full response:
"HTTP/1.1 401 Unauthorized
Content-Type: text/html; charset=us-ascii
Server: Microsoft-HTTPAPI/2.0
WWW-Authenticate: NTLM TlRMTVNTUAACAAAACAAIADgAAAAFAoECO4RVYA0DyWEAAAAAAAAAAHwAfABAAAAABgGwHQAAAA9DAEUAUgBOAAIACABDAEUAUgBOAAEAEgBDAEUAUgBOAFcAUwBTADAANgAEAA4AYwBlAHIAbgAuAGMAaAADACIAQwBFAFIATgBXAFMAUwAwADYALgBjAGUAcgBuAC4AYwBoAAUADgBjAGUAcgBuAC4AYwBoAAcACACa3tflU0zMAQAAAAA=
Date: Wed, 27 Jul 2011 11:54:10 GMT
Content-Length: 341"
kio_http(10546)/kio_http_debug HTTPProtocol::readResponseHeader: Content-type: "text/html"
kio_http(10546)/kio_http_debug HTTPProtocol::readResponseHeader: Encoding-type: "charset" = "us-ascii"
kio_http(10546)/kio_http_debug HTTPProtocol::readResponseHeader: parsing authentication request; response code = 401
kio_http(10546)/kio_http_debug HTTPProtocol::readResponseHeader: pointer to auth class is now 0x231fcc0
kio_http(10546)/kio_http_debug HTTPProtocol::readResponseHeader: Trying authentication scheme: "NTLM"
kio_http(10546)/kio_http_debug HTTPProtocol::readResponseHeader: Auth State: isError= false needCredentials= true forceKeepAlive= true forceDisconnect= false headerFragment= "NTLM ****************"
kio_http(10546)/kio_http_debug HTTPProtocol::fixupResponseMimetype: before fixup "text/html"
kio_http(10546)/kio_http_debug HTTPProtocol::fixupResponseMimetype: after fixup "text/html"
kio_http(10546)/kio_http_debug HTTPProtocol::readBody: "341" bytes left.
kio_http(10546)/kio_http_debug HTTPProtocol::readBody: EOD received! Left = "0"
kio_http(10546)/kio_http_debug HTTPProtocol::cacheFileClose:
kio_http(10546)/kio_http_debug HTTPProtocol::cacheFileClose:
kio_http(10546)/kio_http_debug HTTPProtocol::sendQuery:
kio_http(10546)/kio_http_debug HTTPProtocol::satisfyRequestFromCache:
kio_http(10546)/kio_http_debug HTTPProtocol::cacheFileOpenRead:
kio_http(10546)/kio_http_debug HTTPProtocol::cacheFileClose:
kio_http(10546)/kio_http_debug HTTPProtocol::httpShouldCloseConnection: Keep Alive: true
kio_http(10546)/kio_http_debug HTTPProtocol::sendQuery: sent it!
kio_http(10546)/kio_http_debug HTTPProtocol::readResponseHeader:
kio_http(10546)/kio_http_debug HTTPProtocol::readResponseHeader: wasAuthError= true isAuthError= true sameAuthError= true

Comment 5 LuRan 2011-08-20 02:23:56 UTC

After some debuging, tt turns out the bug is cause by 847f0740534163414b4e15bb8bd749b5414b7a5d, it accidentally reverted 6a0405e18e96ddef3ac3d2f0baa7e696c26aab22

Comment 6 Dawit Alemayehu 2011-08-20 07:26:54 UTC

(In reply to comment #5)
> After some debuging, tt turns out the bug is cause by
> 847f0740534163414b4e15bb8bd749b5414b7a5d, it accidentally reverted
> 6a0405e18e96ddef3ac3d2f0baa7e696c26aab22

Stupid me! I fixed it and then broke it by causing the regression! Oh well... Thanks for all the work debugging this problem. I will fix it immediately.

Comment 7 Dawit Alemayehu 2011-08-20 07:34:06 UTC

Git commit aa8589d816880190c5f18eda1aeb5b709eebbf13 by Dawit Alemayehu.
Committed on 20/08/2011 at 09:29.
Pushed by adawit into branch 'KDE/4.7'.

Put back accidentally reverted fix that fixed broken NTLM
authentication.

BUG: 278617
FIXED-IN: 4.7.1

M  +4    -2    kio/misc/kntlm/kntlm.cpp

http://commits.kde.org/kdelibs/aa8589d816880190c5f18eda1aeb5b709eebbf13