HTTP Authentifizierung

Transcription

1 HTTP Authentifizierung Valentin Lein Matr. Nr Computer Technology /21

2 Inhalt HTTP Basic Authentication Alternative Authentifizierungsmöglichkeiten HTTP Hypertext Transfer Protocol Computer Technology Valentin Lein 2/21

3 HTTP Basic Authentication Internet Engineering Task Force (IETF): RFC 2617 HTTP Authentication: Basic and Digest Access Authentication Client muss sich beim Server Authentifizieren Nur Base64-Codierung -> Unsicher Computer Technology Valentin Lein 3/21

4 HTTP Basic Authentication - Ablauf Client 1: Request Server 2: 401 Unauthorized WWW-Authenticate: Basic 3: GET Authorization: Basic Base64-Message 5: 200 Ok Computer Technology Valentin Lein 4/21

5 Request Hypertext Transfer Protocol GET /skripten/feto/online2002/index.html HTTP/1.1 Host: User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; de; rv: ) Gecko/ Firefox/ Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3 Accept-Encoding: gzip,deflate Accept-Charset: ISO ,utf-8;q=0.7,*;q=0.7 Connection: keep-alive Referer: Computer Technology Valentin Lein 5/21

6 Authentification Required Hypertext Transfer Protocol HTTP/ Authorization Required Request Version: HTTP/1.1 Response Code: 401 Date: Mon, 13 Dec :42:14 GMT Server: Apache WWW-Authenticate: Basic realm="feto" Content-Length: 519 Keep-Alive: timeout=15, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso Line-based text data: text/html Computer Technology Valentin Lein 6/21

7 Aufforderung des Users zur Authentifikation Computer Technology Valentin Lein 7/21

8 Authentifikation des Clients Hypertext Transfer Protocol GET /skripten/feto/online2002/index.html HTTP/1.1 Request Method: GET Request URI: /skripten/feto/online2002/index.html Request Version: HTTP/1.1 Host: User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; de; rv: ) Gecko/ Firefox/ Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3 Accept-Encoding: gzip,deflate Accept-Charset: ISO ,utf-8;q=0.7,*;q=0.7 Keep-Alive: 115 Connection: keep-alive Referer: Authorization: Basic ZmV0bzpmZXRv Credentials: feto:feto Computer Technology Valentin Lein 8/21

9 Response OK Hypertext Transfer Protocol HTTP/ OK Request Version: HTTP/1.1 Response Code: 200 Date: Mon, 13 Dec :42:14 GMT Server: Apache Last-Modified: Mon, 07 Jun :43:32 GMT ETag: "5542b dc42f1c05d00" Accept-Ranges: bytes Content-Length: 1057 [Content length: 1057] Keep-Alive: timeout=15, max=99 Connection: Keep-Alive Content-Type: text/html Line-based text data: text/html Computer Technology Valentin Lein 9/21

10 Alternativen zu Basic Authentication HTTP+HTML Form-Based Authentication Digest Access Authentication NTLM (kurz für NT LAN Manager) Authentication Computer Technology Valentin Lein 10/21

11 HTTP+HTML Form-Based Authentication Client Server 1: Request 2: HTML Form:username?, password?, "login button 3: From data: username, password 5: Ok Computer Technology Valentin Lein 11/21

12 Digest Access Authentication Wie Basic Authentication im IETF: RFC 2617 Client muss beim Authentifizieren MD5 Verschlüsselung verwenden MD5 Message-Digest Algorithm 5 Computer Technology Valentin Lein 12/21

13 Bsp. aus RFC Username: "Mufasa Password: "Circle Of Life Computer Technology Valentin Lein 13/21

14 Authentification Required HTTP/ Unauthorized WWW-Authenticate: Digest qop="auth,auth-int, nonce="dcd98b7102dd2f0e8b11d0f600bfb0c093", opaque="5ccc069c403ebaf9f0171e9517f40e41 Content-Type: text/html Computer Technology Valentin Lein 14/21

15 Aufforderung des Users zur Authentifikation Mufasa Computer Technology Valentin Lein 15/21

16 Berechnung der Response 1. Der MD5 hash der Kombination: Username, Authentication realm und Password wird berechnet => HA1. 2. Der MD5 hash der Kombination: method und digest URI wird berechnet, hier "GET" und "/dir/index.html". => HA2. 3. Der MD5 hash des HA1, server nonce (nonce), request counter (nc), client nonce (cnonce), quality of protection code (qop) und HA2 wird berechnet =>"response" Computer Technology Valentin Lein 16/21

17 Authentifikation des Clients Authorization: Digest username="mufasa", nonce="dcd98b7102dd2f0e8b11d0f600bfb0c093", uri="/dir/index.html", qop=auth, nc= , cnonce="0a4f113b", response="6629fae49393a c4ef1", opaque="5ccc069c403ebaf9f0171e9517f40e41 Computer Technology Valentin Lein 17/21

18 Server response OK HTTP/ OK Server: HTTPd/0.9 Date: Sun, 10 Apr :27:03 GMT Content-Type: text/html Content-Length: 7984 Computer Technology Valentin Lein 18/21

19 NTLM (NT LAN Manager) Authentication Challenge-Response-Authentifizierung Ursprünglich proprietäres Protokoll von Microsoft seit 2007 veröffentlicht Computer Technology Valentin Lein 19/21

20 NTLM Authentication Client 1: GET Server 2: 401 Unauthorized WWW-Authenticate: NTLM 3: GET Authorization: NTLM base64-encoded username 4: 401 Unauthorized WWW-Authenticate: NTLM <base64-encoded type-2-message> Challenge 5: GET Authorization: NTLM <base64-encoded type-3-message> hashed Challenge 6: 200 Ok Computer Technology Valentin Lein 20/21

21 Thank you for your attention! Computer Technology Valentin Lein 21/21

22 Quellen: Basic und Digest Access Authentication NTLM Authentication Computer Technology Valentin Lein 22/21