[Samba] ntlm_auth not returning "STATUS_OK"

[Mark Foley]

On Wed Jan 24 05:03:25 2024 Rowland Penny via samba <samba at lists.samba.org> wrote:
>
> On Tue, 23 Jan 2024 17:07:35 -0500
> Mark Foley via samba <samba at lists.samba.org> wrote:
>
> > On Mon Jan 22 11:00:59 2024 Mark Foley via samba
> > <samba at lists.samba.org> wrote:
> > >
> > > I have scripts that runs ntlm_auth. Before upgrading my DC to
> > > 4.18.9 I would get text string output from the ntlm_auth command.
> > > For example:
> > >
> > > STATUS_NO_SUCH_USER
> > > NT_STATUS_WRONG_PASSWORD
> > > STATUS_OK
> > >
> > > Now with the new Samba, the first two strings are output as usual
> > > in the case of non-existant user and invalid password,
> > > respectively, but if the user/pw is OK it now returns the string:
> > > ":  (0x0)", which, I suppose, is the exit status of the ntlm_auth
> > > command meaning OK.
> > >
> > I have never been in favor of developers changing the behavior of
> > programs when "new features" come out, expecially programs that might
> > be used in scripts that rely on responses.  I think it's naughty when
> > developers do that.
> >
> > > <snip>
> >
> > --Mark
> > 

> Sooner or later, ntlm_auth wil be removed, so if you can find another
> way for your script to do what it is doing now, then you may be wise to
> do so.
> In the meantime, it might be a good idea to log a bug report.
>
> Rowland

The application ntlm_auth is used for is an intranet web application which is a
pension system implemented in HTML, JSP and SQL Server. User/employees must log
in to use this webapp. Rather than maintain separate app-only credentials, the
users can authenticate with their domain credentials. This is where ntlm_auth
comes in.

I would be very sorry to see ntlm_auth go away. A quick web search shows I'm not
the only one using it. This reinforces my comment about developers removing
longstanding functionality without a compatible path forward. That places a
burden on downstream developers who have come to rely on functionality.

Windows has long permitted authentication of its apps with domain credentials,
whether Access, SQL Server, Outlook, etc. It would be a shame for Linus to take
a step backward in this regard.

Do you know of anything besides ntlm_auth that will authenticate a domain user
on the command line?

I'll search for JSP jarfiles that might do that, but my brief search on that has
not been promising thus far.

--Mark