...
Note that the web server repponds that the browser it is not authorized to access the web server (the {[HTTP/1.x 401 Unauthorized}} tells you tisthis), and that the only valid form of authentication that the web server will accept is IWS (which is what the WWW-Authenticate: NTLM line tells you). Since IWA is built into the browser (in this case FireFox 1.0), it prompts the user for their username and password. A hash of these credentials (not the credentials themselves) is passed to the web server (in the line Authorization: NTLM TlRMTVNTUAABAAAAB4IIAAAAAAAAAAAAAAAAAAAAAAA=), which allows the web server look up the user in the Windows password database and to construct a unique encrypted challenge that the browser can only decrypt with the user's unique password. The long line of characters sent by the web server to the broswer (after the {{WWW-Authenticate: NTLM }} in the diabgram below) is the encrypted challenge:
| Panel |
|---|
| borderColor | #ccc |
|---|
| bgColor | #FFFFCE |
|---|
| titleBGColor | #F7D6C1 |
|---|
| title | User Visits http://glast-ground.slac.stanford.edu/ |
|---|
| borderStyle | dashed |
|---|
|
http://glast-ground.slac.stanford.edu/ Image Added GET / HTTP/1.1
Host: glast-ground.slac.stanford.edu
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.5) Gecko/20041107 Firefox/1.0
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,/;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Cookie: CFTOKEN=84811003; CFID=906
Authorization: NTLM TlRMTVNTUAABAAAAB4IIAAAAAAAAAAAAAAAAAAAAAAA= HTTP/1.x 401 Unauthorized
Content-Length: 1539
Content-Type: text/html
Server: Microsoft-IIS/6.0
WWW-Authenticate: NTLM TlRMTVNTUAACAAAACAAIADgAAAAFgokCub9Oy9DBXqAAAAAAAAAAALwAvABAAAAABQLODgAAAA9TAEwAQQBDAAIACABTAEwAQQBDAAEADgBHAEwAQQBTAFQAMAA1AAQAKgB3AGkAbgAuAHMAbABhAGMALgBzAHQAYQBuAGYAbwByAGQALgBlAGQAdQADADoAZwBsAGEAcwB0ADAANQAuAHcAaQBuAC4AcwBsAGEAYwAuAHMAdABhAG4AZgBvAHIAZAAuAGUAZAB1AAUAKgB3AGkAbgAuAHMAbABhAGMALgBzAHQAYQBuAGYAbwByAGQALgBlAGQAdQAAAAAA
Date: Sun, 19 Dec 2004 01:24:06 GMT |