[jcifs] Problems with NtlmServlet and post method

[eglass1 at comcast.net]

> hi,
> 
> thank you Eric, that's a clear now.
> 
> But hey, is it possible to change Authorization header during the session?
> 
> For example at first "Authorization header = NTLM" and after the
> authorization "Authorization header = none". Then, there no need any
> handshakes??
> 

Not sure what you mean... are you asking whether NTLM auth will be required
for every request?  If the user has not yet authenticated, the NtlmServlet will
send a "WWW-Authenticate" header requesting NTLM authentication.  Upon
successful authentication, the servlet will store the NtlmHttpAuth attribute
in the session (containing an NtlmPasswordAuthentication object).  If that
attribute is present in the session on subsequent requests, the servlet will
not ask the client to reauthenticate.

If the user does a POST, however, the client will proactively send the
authorization information (containing the Type 1 message); the servlet will accept this
and respond with the appropriate Type 2 challenge.

Does that answer your question?

Eric