NTLM support in Android

[steveisok]

Some time ago in mono's corefx fork, we switched to SocketsHttpHandler and discovered that NTLM auth stopped working on Android. Originally, we thought it was just a configuration miss on our part, but it ended up turning out to be that kerberos is not available on Android and thus neither is libkrb-5.

We have been able to suggest a workaround by having customers use our old http handler, but w/ .NET 5 I believe we are going to need to work this out. I'm opening this issue to start a discussion / gather ideas.

[jkotas]

What makes the NTLM auth work in the old http handler?

[am11]

Previously termux krb5 package was used from their main set to compile corefx: https://github.com/termux/termux-packages/tree/master/packages/krb5. Current android build scripts are little out of sync (mainly they haven't been modernized with others), but I think if termux is an option in your build process, that package should work.

[filipnavara]

What makes the NTLM auth work in the old http handler?

If I had to guess it's the fact that MonoWebRequestHandler (the old handler) wraps HttpWebRequest. On Mono the implementation of HttpWebRequest is totally different from the CoreFX one and it implements NTLM in managed code. The NTLM implementation is limited to password-based credentials but it's still better than nothing.

[marek-safar]

@karelz we need a decision on how we can support NTLM on Android. The proposed solution is to include a fork of krb5 package in dotnet/ org so we can reference it as part of dotnet/runtime build and package it for Android where this library is not available. Is this something your team can take on or do you have another idea?

[am11]

re: libkrb5 - took this as a motivation and renewed the android support; with #32800 and accompanying PRs, we were able to build libraries with kerberos support. I have not tested SocketsHttpHandler on the device but the compilation finds gssapi headers and links with library.

Packages containing libkrb5.so: arm and aarch64.

after the arm64 compilation:

$ readelf -d  artifacts/obj/native/Linux-arm64-Debug/System.Net.Security.Native/System.Net.Security.Native.so  | grep NEEDED
 0x0000000000000001 (NEEDED)             Shared library: [libgssapi_krb5.so.2]
 0x0000000000000001 (NEEDED)             Shared library: [libm.so]
 0x0000000000000001 (NEEDED)             Shared library: [libdl.so]
 0x0000000000000001 (NEEDED)             Shared library: [libc.so]

$ readelf -d .tools/android-rootfs/android-ndk-r21/sysroot/usr/lib/libgssapi_krb5.so.2 | grep NEEDED
 0x0000000000000001 (NEEDED)             Shared library: [libkrb5.so.3]
 0x0000000000000001 (NEEDED)             Shared library: [libk5crypto.so.3]
 0x0000000000000001 (NEEDED)             Shared library: [libcom_err.so.3]
 0x0000000000000001 (NEEDED)             Shared library: [libkrb5support.so.0]
 0x0000000000000001 (NEEDED)             Shared library: [libandroid-glob.so]
 0x0000000000000001 (NEEDED)             Shared library: [liblog.so]
 0x0000000000000001 (NEEDED)             Shared library: [libc.so]
 0x0000000000000001 (NEEDED)             Shared library: [libandroid-support.so]
 0x0000000000000001 (NEEDED)             Shared library: [libdl.so]

$ find .tools/ -name libkrb5*
.tools/android-rootfs/tmp/aarch64/data/data/com.termux/files/usr/lib/libkrb5support.so
.tools/android-rootfs/tmp/aarch64/data/data/com.termux/files/usr/lib/libkrb5.so.3.3
.tools/android-rootfs/tmp/aarch64/data/data/com.termux/files/usr/lib/libkrb5.so
.tools/android-rootfs/tmp/aarch64/data/data/com.termux/files/usr/lib/libkrb5support.so.0
.tools/android-rootfs/tmp/aarch64/data/data/com.termux/files/usr/lib/libkrb5.so.3
.tools/android-rootfs/tmp/aarch64/data/data/com.termux/files/usr/lib/libkrb5support.so.0.1
.tools/android-rootfs/android-ndk-r21/sysroot/usr/lib/libkrb5support.so
.tools/android-rootfs/android-ndk-r21/sysroot/usr/lib/libkrb5.so.3.3
.tools/android-rootfs/android-ndk-r21/sysroot/usr/lib/libkrb5.so
.tools/android-rootfs/android-ndk-r21/sysroot/usr/lib/libkrb5support.so.0
.tools/android-rootfs/android-ndk-r21/sysroot/usr/lib/libkrb5.so.3
.tools/android-rootfs/android-ndk-r21/sysroot/usr/lib/libkrb5support.so.0.1

[karelz]

@marek-safar we intentionally reimplemented NTLM in C# for SocketsHttpHandler to avoid adding more dependencies. Overall we are trying to limit the number of dependencies as much as possible.
Is there a reason why Android cannot take the same approach and reuse the simple NTLM implementation?
UPDATE: Sorry, I was wrong, we do not have it in C# :(

@wfurt @davidsh may have more thoughts on general authentication and Kerberos integration into SocketsHttpHandler.

[davidsh]

@wfurt @davidsh may have more thoughts on general authentication and Kerberos integration into SocketsHttpHandler.

Strictly speaking 'libkrb5' doesn't support NTLM; either raw NTLM nor 'Negotiate' protocol where Kerberos falls back to NTLM. On Linux that requires a separate 'gss-ntlmssp' package to be installed which is a plug in to the GSS-API that 'libkrb5' generally supports on Linux. On MacOS, it turns out that their 'libkrb5' bundle includes NTLM support. But that is also because MacOS ships the Heimdal implementation of the GSS-API and not the MIT Kerberos implementation that Linux distros support.

@karelz we need a decision on how we can support NTLM on Android. The proposed solution is to include a fork of krb5 package in dotnet/ org so we can reference it as part of dotnet/runtime build and package it for Android where this library is not available. Is this something your team can take on or do you have another idea?

I think we need to discuss this further. I'm currently not a fan of .NET Libraries owning a forked copy of 'libkrb5'.