[jcifs] Is the work-around also the answer?

[Michael B Allen]

On Mon, Oct 24, 2011 at 8:09 AM, Bret Comstock Waldow <bcw1000 at yahoo.com> wrote:
<snip>
> Please stop telling me to abandon it and instead please help me learn
> about it.  Whatever you know about it is useful today to a lot of people.

Wow, that was a long email that had little to do with software. I
can't believe I read it all.

I have literally not even looked at the JCIFS HTTP Filter code in
almost 10 years. So even though I actually wrote it, I remember very
little about it. I vaguely remember something about
"pre-authentication" but I don't recall what it does precisely. And we
are not in a "hurry to bury it" because it is buried. The only reason
it's still in the package is because the plan (currently) is to just
release a 2.0 and leave it in 1.x. But 2.0 has been on hold because I
don't have that much Free time.

All I can tell you is that many people have used that Filter and they
also claim it works well and I suspect it will continue to work as
long as your domain security policy permits NTLMv1. However, again,
NTLMv1 can be cracked pretty easily so eventually someone is going to
change security policy on the domain and suddenly it will stop
working. And in truth, it actually does not work that well (eg no
failover).

Mike