[SVN-2693] NTLM/SSPI authentication against proxy fails

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.5.x
• Fix Version/s: 1.5.0
• Component/s: libsvn_ra_neon

Environment

Windows 2000

• Assignee: Unassigned
• Reporter: Subversion Importer
• Created: 10/Jan/07 10:22
• Updated: 27/Oct/18 16:34
• Resolved: 10/Mar/09 15:22

Description

Numerous user requests show that Subversion is unable to authenticate against
NTLM/SSPI proxy properly resulting in the following error messages while other
programs (such as FireFox, IE etc) work as expected without requesting any
credentials:

C:\>svn co https://colorer.svn.sourceforge.net/svnroot/colorer/trunk/colorer colorer
svn: PROPFIND request failed on '/svnroot/colorer/trunk/colorer'
svn: PROPFIND of '/svnroot/colorer/trunk/colorer': Could not create SSL
connection through proxy server (https://colorer.svn.sourceforge.net)

C:\>svn co http://colorer.svn.sourceforge.net/svnroot/colorer/trunk/colorer colorer
svn: PROPFIND request failed on '/svnroot/colorer/trunk/colorer'
svn: PROPFIND of '/svnroot/colorer/trunk/colorer': 407 Proxy Authentication
Required (http://colorer.svn.sourceforge.net)

Proxy is Squid with all necessary WebDAV requests allowed, detailed logs are at
http://www.svnforum.org/2017/viewtopic.php?t=1967


Users mailing list complaints:
http://subversion.tigris.org/servlets/BrowseList?list=users&by=thread&from=305450
- no solution
http://subversion.tigris.org/servlets/BrowseList?list=users&by=thread&from=436850
- advice to use ntlmaps - complicated, requires python proxy server to be
constantly running in console window, and may not work with SSPI
http://subversion.tigris.org/servlets/ReadMsg?listName=users&msgNo=35246 - the
same problem with libraries from TSVN, no comments
http://subversion.tigris.org/servlets/BrowseList?list=users&by=thread&from=331129
- ntlmaps again
http://subversion.tigris.org/servlets/ReadMsg?listName=users&msgNo=23231 and
http://subversion.tigris.org/servlets/ReadMsg?listName=users&msgNo=23236 -
another complaint and advice to use local administrator
http://subversion.tigris.org/servlets/ReadMsg?list=users&&msgNo=43184 - and
another one
http://subversion.tigris.org/servlets/ReadMsg?listName=users&msgNo=19416 - complaint


http://subversion.tigris.org/servlets/ReadMsg?listName=users&msgNo=46019 -
request to leave an option to switch to basic authentication at least 

http://subversion.tigris.org/servlets/ReadMsg?listName=users&msgNo=42702 -
possible solution!

http://subversion.tigris.org/servlets/ReadMsg?listName=users&msgNo=43187 -
another mail that agrees it is an issue that is not closed yet despite of the
following bugs:
http://subversion.tigris.org/issues/buglist.cgi?Submit+query=Submit+query&component=subversion&issueidtype=include&chfieldfrom=&chfieldto=Now&long_desc=ntlm&long_desc_type=substring&order=Issue+Number



Developers discussion:
Seems like NTLM proxy authentication support is disabled at compilation stage
http://subversion.tigris.org/servlets/ReadMsg?list=dev&msgNo=122533 it could
also be that this link from above contains the solution
http://subversion.tigris.org/servlets/ReadMsg?listName=users&msgNo=42702

Original issue reported by techtonik