Subject: Mixed http2/1.1 Authentication

From: Dennis Olvany <[email-masked]>
Date: Sat, 12 Mar 2016 16:16:14 +0000

Hello,

I am interested in understanding the interoperability of http
authentication in a mixed http2/1.1 deployment. The use case is http2
between client and load balancer (ssl offload), then http1.1 between load
balancer and server. Authentication occurs at the server, not the load
balancer. My understanding is that the authorization header is sent with
every request, but perhaps this is not the case if the client is performing
http2 header compression. It seems logical that it should be the
responsibility of the intermediary to cache and transmit the header with
each request. Does the standard stipulate the behavior of clients and
intermediaries to support authentication in a mixed design? Are there any
known limitations with such a design?

-Dennis

---

From: Ilari Liusvaara <[email-masked]>
Date: Sat, 12 Mar 2016 18:44:30 +0200

> known limitations with such a design?

Basically, the header is logically sent in every request (that is to be
authenticated), even if header compression compresses it to zero space.

So if the load balancer can forward to multiple servers, it needs to
take the header compression context into account for each request.

-Ilari

---

From: Dennis Olvany <[email-masked]>
Date: Sat, 12 Mar 2016 17:36:24 +0000

Thanks, Ilari. After further research, it looks like I may be running into
the http2 incompatibility with ntlm. Is this limitation applicable to the
mixed use case? Is anyone aware of a good write up which explains the ntlm
incompatibility?

-Dennis
On Sat, Mar 12, 2016 at 11:44 AM Ilari Liusvaara <[email-masked]>

---

From: Daniel Stenberg <[email-masked]>
Date: Sat, 12 Mar 2016 22:50:15 +0100 (CET)

> mixed use case? Is anyone aware of a good write up which explains the ntlm 

NTLM authenticates *connections* not requests (as HTTP auth was always meant 
to). HTTP/2 do (short-lived) streams over a single connection.

The two concepts really don't match very well.

-- 

  / daniel.haxx.se

---

From: Amos Jeffries <[email-masked]>
Date: Sun, 13 Mar 2016 15:59:42 +1300

On 13/03/2016 10:50 a.m., Daniel Stenberg wrote:
>> Thanks, Ilari. After further research, it looks like I may be running
>> into the http2 incompatibility with ntlm. Is this limitation
>> applicable to the mixed use case? Is anyone aware of a good write up
>> which explains the ntlm incompatibility?
> 
> NTLM authenticates *connections* not requests (as HTTP auth was always
> meant to). HTTP/2 do (short-lived) streams over a single connection.
> 

Note that NTLM is also incompatible with HTTP/1.x.

Middleware has to actively disable almost all useful HTTP functionality
when NTLM (or Negotiate) is being relayed on a connection.

Amos

---

From: Mike Bishop <[email-masked]>
Date: Mon, 14 Mar 2016 18:15:05 +0000

See https://www.ietf.org/archive/id/draft-montenegro-httpbis-multilegged-auth-01.txt for more on this. In short, multi-legged auth schemes don't mesh well with multiplexed requests. You can do some modifications to make this work, but the working group chose not to adopt this draft. Currently, Windows will fall back to HTTP/1.1 if either client or server attempt to use NTLM.

From: Dennis Olvany [mailto:[email-masked]]
Sent: Saturday, March 12, 2016 9:36 AM
To: Ilari Liusvaara <[email-masked]>
Cc: [email-masked]
Subject: Re: Mixed http2/1.1 Authentication

Thanks, Ilari. After further research, it looks like I may be running into the http2 incompatibility with ntlm. Is this limitation applicable to the mixed use case? Is anyone aware of a good write up which explains the ntlm incompatibility?

-Dennis
On Sat, Mar 12, 2016 at 11:44 AM Ilari Liusvaara <[email-masked]<mailto:[email-masked]>> wrote:

-Ilari