Hello,

i use the NTLM Authentification from this Page here:
http://jastraub.blogspot.com/2008/03/ntlm-http-authentication-and.html

It works perfectly but after the Security Update KB963027 for IE7 from Microsoft has been installed, only "nobody" and it doesn't work any more.
When i uninstall the KB963027 everything works back fine.

Does someone here use this NTLM Authentication and has the Security Update installed too?

The Problem is that i can't uninstall the Patch on every client because the updates are forced from our Win2k3 Domain Administrators and in our OU we aren't allowed to change anything about this.

I tried to find out which part of the KB963027 let's the problem occur.

1st Try:
- NTLM works
- saved the registry (C:\windows\system32\config)
- installed KB963027
- rebooted computer
- NTLM doesn't work
- restore the registry (but not the dll-files which were changed within the update)
- rebooted computer
- NTLM still doesnt' work!
conclusion: it is not a registry key which occurs the error

2nd Try:
- NTLM works
- saved all DLL's and EXE's which were changed within the update
- installed KB963027
- rebooted computer
- NTLM doesn't work
- restore all DLL's and EXE's from the old situation
- rebooted computer
- NTLM still doesn't work
conslusion: also the change of the dll's und exe's doesn't occur the error

3rd Try:
- NTLM works
- saved the registry (C:\windows\system32\config)
- saved all DLL's and EXE's which were changed within the update
- installed KB963027
- rebooted computer
- NTLM doesn't work
- restore the registry (but not the dll-files which were changed within the update)
- restore all DLL's and EXE's from the old situation
- rebooted computer
- NTLM still doesnt' work!
conslusion: what the ****!? why does it work again when i uninstall it via windows and doesn't work again when i restore registry and the changed files!? that doesn't make any sense.

Help!

user498030:

I believe KB963027 has changed the way the browser reports that the user is prompted for username/password so the following logic no longer works:

if utl_raw.cast_to_binary_integer(utl_raw.substr(l_raw,14,1)) != 130 then

so it always goes to the else logic, which is:

else
l_username := 'nobody';

I will try to take a look and see if I can figure out if there is a way to change the logic but we are heavy in 4.0 development so I cannot dedicate too much time to it.

Regards,

Jason

Oh that's bad. I thought you would have an idea to this.
But thank you very much for trying!

Do you know if the MOD_NTLM is also affected or does this method of NTLM authenticataion still work?

Thank you

This "hack" works for me too, but it is not possible to change this Registry Key in our whole Win2k3 OU.

So i need another solution. Again, does someone know if MOD_NTLM works with the Security Update or does it use the same method to authenticate?