Document behavior with hostname redirection

[bruceceng]

In order to authenticate the server hostname must be a specific value (I have only tested "http://localhost:3000/"). If I try to authenticate with http://sspi.auth.local:3000/ (where sspi.auth.local redirects to localhost in the windows hosts file) then the authentication fails.

I guess this is by the design of Kerberos and/or NTLM that the browser (client) must only generate correct credentials for a proper server name. It just seems like this could be better documented.

I encountered the problem when testing a server with HTTPS, since many solutions suggest setting the fully qualified domain name specified in the certificate to a form like "[testname].local".

After some investigation I found that the client can be called with setTargetName("localhost") even when connecting to http://sspi.auth.local:3000 and get the correct behavior.

[Jean-Louis GUENEGO]

Yes these aspects need to be better documented.

…

On Wednesday, August 12, 2020, bruceceng ***@***.***> wrote: In order to authenticate the server hostname must be a specific value (I have only tested "http://localhost:3000/"). If I try to authenticate with http://sspi.auth.local:3000/ (where sspi.auth.local redirects to localhost in the windows hosts file) then the authentication fails. I guess this is by the design of Kerberos and/or NTLM that the browser (client) must only generate correct credentials for a proper server name. It just seems like this could be better documented. I encountered the problem when testing a server with HTTPS, since many solutions suggest setting the fully qualified domain name specified in the certificate to a form like "[testname].local". After some investigation I found that the client can be called with setTargetName("localhost") even when connecting to http://sspi.auth.local:3000 and get the correct behavior. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#31>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAVV6TVKDD2T7MXDDRNMIDTSALJVFANCNFSM4P5B4LMQ> .

-- Envoyé avec Gmail Mobile

[Jean-Louis GUENEGO]

I added at the top of the README two links that will be completed with times, and user feedback. One of them is about error analysis.

I started with your use case.

Hope this help.