Re: problem using NTLM authentication with default OS credentials
Date: Sat, 12 Jul 2014 17:00:47 +0100
On Fri, 2014-07-11 at 15:50 +0200, Michael Osipov wrote:
> I my opinion, we can refer to the HTTP standard which mandates to use
> strongest to weakest auth. So curl would actually need to priorize
> authentication and try in that order:
> Kerberos > Negotiate > Digest > NTLM_WB > NTLM > Basic.
> KRB 5 comes before SPNEGO, bcause it can downgrade to NTLM which is less
> secure. Digest comes before NTLM because, again, less secure and
Another point of view would be that NTLM_WB comes before Digest. You are
focusing on the protocol on the wire, which is too narrow.
In the grand scheme of things, automatic authentication with single sign
on *has* to be better than making the user pass a password around to
curl in cleartext so that it can do the Digest auth for itself.
- application/x-pkcs7-signature attachment: smime.p7s