开发者

Why no Authorization Header received in SSO?

开发者 https://www.devze.com 2023-01-21 15:26 出处：网络

I implement a SSO with NTLM and passthru, and it works if our client had joined into domain. As in our code we will check if there is a \"Authorization header\" in the reques开发者_JAVA技巧t header. A

相关专题：authorization ntlm passthru single-sign-on

I implement a SSO with NTLM and passthru, and it works if our client had joined into domain. As in our code we will check if there is a "Authorization header" in the reques开发者_JAVA技巧t header. And the problem is:

If our client joined domain, then in our application, I can receive the Authentication header which contain NTLM ...
If our client didn't join domain and login buy key in the username and password, no Authorization header are received, so I can not authorized them.
My problem is : How can I make all the client can send Authorization header all the time even though they didn't join domain ?

If 'Authorization" header is missing in request, you should respond with HTTP status 401 along with "WWW-Authenticate" response header to force clients to login and send "Authorization" request header.