Windows authentication about vba-web

[opoani]

If you want windows authentication and SSO then you might try this hack by changing :

Public Function PrepareHttpRequest(Request As RestRequest, TimeoutMS As Long, _
    Optional UseAsync As Boolean = False) As Object
    Dim http As Object
    Set http = CreateObject("WinHttp.WinHttpRequest.5.1")
    'This is the options: 
'typedef enum WinHttpRequestAutoLogonPolicy { 
 ' AutoLogonPolicy_Always             = 0,
 ' AutoLogonPolicy_OnlyIfBypassProxy  = 1,
'  AutoLogonPolicy_Never              = 2
' } WinHttpRequestAutoLogonPolicy;

    http.SetAutoLogonPolicy 0

    ' Set timeouts
    http.setTimeouts TimeoutMS, TimeoutMS, TimeoutMS, TimeoutMS

    ' Pass http to request and setup onreadystatechange
    If UseAsync Then
        Set Request.HttpRequest = http
        http.onreadystatechange = Request
    End If

    Set PrepareHttpRequest = http
End Function

Potential unexpected side effects, well might be so haven't tested all cases.
It worked for me to do post / get towards an internal WCF with windows security. That said the conclusion is that your mileage might vary...

(Added code formatting)

[timhall]

Hi @sravikiran, I'm not too familiar with Windows authentication, but I think the following should help. First, I would recommend checking out the wiki for details on implementing your own IAuthenticator. Using that approach, I would skip the Setup step, use the standard HttpOpen, and define the following BeforeExecute:

Private Function GenerateToken(Username As String) As String
    ' Your specific details for generating a token
    GenerateToken = Username
End Function

Private Sub IAuthenticator_BeforeExecute(Request As RestRequest)
    Request.AddHeader "Authorization", GenerateToken(Application.UserName)
End Sub

Reading more about "Windows integrated authentication" (NTLM) (this Stack Overflow question has a good breakdown) it seems much more complicated than simply creating a token based on the user id, is that what you are trying to implement? If so, I can look into creating a Windows Integrated Authenticator.

[sravikiran]

Hi @timhall ,

Sorry for the slow response. Thanks for the insights. I wasn't aware that the windows authenticator sends messages with the request to the server to get the user authenticated. When I hit the get endpoints of the REST API using a browser, the browser sets the Authorization header value, I thought it is the authorization token.

It will be great if you can create an authenticator for Windows Integrated Authentication, as it will be useful for anyone looking for what I asked here. Thanks.

[kimptoc]

Hi,

Not sure what kind of Windows authentication you need, but I have an internal site that uses Windows Auth.

If you need a manual/specific set of credentials used, then these can be passed on the open call, as seen here:
http://zanstra.home.xs4all.nl/inTec/ServerXMLHTTP.htm

Thus a custom Windows version of IAuthenticator could be created.

What I need is to use the current users credentials, which happens auto-magically if you use XMLHTTP instead of ServerXMLHTTP. So I switched the PrepareHttpRequest function to create one of those instead and that worked without specifying credentials anywhere.

It does not seem to have a setTimeouts method (at least not with the same name).

Any reason why ServerXMLHTTP is used, as opposed to the XMLHTTP class?

[timhall]

@opoani Cool! I was just about to write this off, I'll see if I can integrate that in v4.0.0