Function requested not supported in SSPI about px

[genotrance]

What version of Windows are you running? Also, are you logging in with an NTLM password (domain login) or logging in with a local user account?

[lalalandrus]

Windows 10 64 bit

[genotrance]

Are you logging in with an NTLM password (into a domain account since machine is part of the domain) or logging in with a local user account? If it is the latter, there's no SSPI possible from what I understand.

[lalalandrus]

It is on a corporate domain.

[genotrance]

Can you please confirm the following:-

• Does the binary distribution of Px work on your system? Either 32-bit or 64-bit?
• Does the 32-bit distro of 2.7 Python work on your system?
• How about 3.5 if you get a chance to try that out?

Not really sure why the system isn't working as expected.

[lalalandrus]

Thanks for getting back to me. At the moment I have found a workaround that does not require the use of PX. I did however try 32 bit version which fails as well. It seems to fail the security portion of the proxy. I still kept getting a 407 unauthorized.

I will see if I can get a chance to use 3.5 to test it out.

[spequer]

I got the similar issue here.

Traceback (most recent call last):
File "D:\tool\python\px-master\px.py", line 100, in create_challenge_response
error_msg, output_buffer = self.sspi_client.authorize(input_buffer)
File "C:\Python35\lib\site-packages\win32\lib\sspi.py", line 139, in authorize
sec_buffer_out)
pywintypes.error: (-2146893048, 'InitializeSecurityContext', 'The token supplied to the function is invalid')

• In a corporation domain
• OS windows7 32bit
• 32bit-distro of 2.7, 3.5

[genotrance]

Thanks for the report - this one is slightly different.

Can you please rerun Px with logging enabled in the INI and in a single process (workers=1)? The logs generated might provide some context which will be helpful to figure out what's going on.

[spequer]

Oops. I got the answer after google the keyword "sspi SEC_E_INVALID_TOKEN" and following the thread on libcurl: https://curl.haxx.se/mail/lib-2014-09/0044.html

It seems related to "scflags, # security context flags" of sspi.ClientAuth.

I set scflags to 0 and px works well.

[genotrance]

Great catch! I presume you are changing the following in Px (class NtlmMessageGenerator):-

self.sspi_client = sspi.ClientAuth("NTLM", user)

to:-

self.sspi_client = sspi.ClientAuth("NTLM", user, scflags=0)

I tried it out and it still works for me, although it works for me even without this. I checked Curl's implementation and they have picked the same in their call to InitializeSecurityContext():-

https://github.com/fl4re/curl/blob/master/lib/curl_sasl_sspi.c

I'll check this in shortly.

[genotrance]

This was checked in a while back but has just been delivered as part of the v0.2.1 binary release. Thank you for providing the fix!