javantlmntlmv2

NTLMv2 Computer account unknown user name

I use ntlmv2 authentication using filter.

I just need to know what is Computer account. Is it a normal account?

My filter is like this:

  <filter><filter-name>ntlmv2-auth</filter-name>
  <filter-class>view.NtlmFilter</filter-class>
  <init-param>
<!-- Windows domain name -->
<param-name>ntlm-domain</param-name>
<param-value>COMP.PS</param-value>
</init-param><init-param>
<!-- IP-address of domain controller -->
<param-name>ntlm-dc</param-name>
<param-value>100.10.1.190</param-value>
</init-param><init-param>
<!-- Simple (non-FQDN) hostname of DC host -->
<param-name>ntlm-dc-name</param-name>
<param-value>hostname</param-value>
</init-param>
<init-param>
<!-- Computer account for connection to DC -->
<param-name>ntlm-account</param-name>
<param-value>Rami.jadallah$@COMP.ps</param-value>
</init-param>
<init-param>
<!-- Password of computer account -->
<param-name>ntlm-password</param-name>
<param-value>abcd@1234/param-value>
</init-param></filter><filter-mapping>
<filter-name>ntlmv2-auth</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
Solution

  • In Windows there are actually two different types of accounts - Computer and User. An NTLMv2 authentication service would have to use a Computer account and not a regular User account because only a Computer account can bind the NETLOGON service.

    But you should just use Jespa instead of whatever you're doing. NTLMv2 authentication is not trivial and Jespa is known to work well and it is properly supported.