When writing an application that talks to a server using NTLM authentication, HttpWebRequest does a three legged authentication handshake that looks as follows:
As you can see, by default, HttpWebRequest does not share connections. The reason is that NTLM is a connection authentication protocol, and not a request authentication protocol like BASIC or DIGEST.
In other words, once an NTLM handshake succeeds, the NTLM credentials stick with the connection. So, if you have a situation (for eg, a web server talking to another webserver using NTLM auth) where there are multiple users with different credentials accessing the front-end server, there is a high risk that an authenticated connection for one user might get used by another user due to connection pooling.
In order to force HttpWebRequest to share NTLM connections, you can do the following:
Setting UnsafeAuthenticatedConnectionSharing will cause all NTLM connections to the same host to be shared.
By setting ConnectionGroupName, you can cause connections to be shared only selectively. In this case, all requests having the same ConnectionGroupName will share connections. You can use this mechanism if you are on the middle-tier scenario.
Related:
System.NET Links and How To's
Tracing with System.Net
The case of multiple NTLM challenges with IIS7
| Client | Server |
| GET / HTTP/1.1 | HTTP/1.1 401 Access Denied Connection: close WWW-Authenticate: NTLM <token> |
| GET / HTTP/1.1 Authorization: NTLM <token1> |
HTTP/1.1 401 Access Denied Connection: close WWW-Authenticate: NTLM NTLM <token> |
| GET / HTTP/1.1 Authorization: NTLM <token2> |
HTTP/1.1 200 OK Connection: close |
As you can see, by default, HttpWebRequest does not share connections. The reason is that NTLM is a connection authentication protocol, and not a request authentication protocol like BASIC or DIGEST.
In other words, once an NTLM handshake succeeds, the NTLM credentials stick with the connection. So, if you have a situation (for eg, a web server talking to another webserver using NTLM auth) where there are multiple users with different credentials accessing the front-end server, there is a high risk that an authenticated connection for one user might get used by another user due to connection pooling.
In order to force HttpWebRequest to share NTLM connections, you can do the following:
Setting UnsafeAuthenticatedConnectionSharing will cause all NTLM connections to the same host to be shared.
By setting ConnectionGroupName, you can cause connections to be shared only selectively. In this case, all requests having the same ConnectionGroupName will share connections. You can use this mechanism if you are on the middle-tier scenario.
Related:
System.NET Links and How To's
Tracing with System.Net
The case of multiple NTLM challenges with IIS7
