Rubyist Justin Bailey has just released RubySSPI, which enables NTLM proxy authentication for Ruby on Windows platforms. RubySSPI interacts with Microsoft's Security Support Provider Interface (SSPI) API to enable Ruby programs using Net::HTTP or open-uri to authenticate as the current Windows user with proxy servers requiring NTLM authentication (e.g. Microsoft's ISA). The library provides bindings to the Win32 SSPI libraries, which implement various security protocols for Windows. It was primarily developed to give Negotiate/NTLM proxy authentication abilities to Net::HTTP (and thus, open-uri), similar to support found in Internet Explorer or Firefox.
The library is not an implementation of the NTLM protocol and does not give the ability to authenticate as any given user. It does authenticate with a proxy server as the current user logged into the given Windows workstation where the code is executing. It also does not provide full bindings to the SSPI library, but the author is accepting patches that extend the library in that direction, if anyone is so inclined. An already suggested future enhancement is to leverage RubySSPI to use NTLM authentication with SQL server, removing the need for usernames or passwords in configuration files.
Godsend for some Windows users
If you are behind a proxy that authenticates all traffic, then this library enables your ruby scripts to authenticate with the proxy as the current user seamlessly. This solves the shortcomings of other solutions which require you to enter your username and password in clear text at least once. After a few simple steps, you should be able to successfully install things like Ruby on Rails by simply typying gem install rails, exactly how non-Windows users get to do.
The inability to do gem install was a big mental barrier to adoption in some Microsoft-heavy shops where I've tried to introduce Ruby and Rails. It was also a huge (and constantly recurring) pain for gem commands to fail when I was stuck at a large client with an ISA proxy/firewall. The biggest problem is that a lot of times, nobody at the client site will know anything about the ISA proxy and attempts to figure out why "my Ruby just doesn't work" will meet with confusion, if not outright hostility.
To make RubyGems (gem) commands work seamlessly behind an ISA firewall just download and install the RubySSPI gem manually, and follow the instructions provided in the Readme.txt file inside the distribution.
Related projects
The extraordinarily comprehensive README provided with the RubySSPI gem even includes a useful list of related resources and open-source projects that were used in decoding both NTLM messages and integrating with the SSPI library:
- Managed SSPI Sample - A .NET implementation of a simple client/server using SSPI. A complex undertaking but provides a great resource for playing with the API.
- John Lam's RubyCLR - Originally, I used RubyCLR to call into the Managed SSPI sample which really helped me decode what the SSPI interface did and how it worked. I did not end up using that implementation but it was great for research.
- The NTLM Authentication Protocol - The definitive explanation for the NTLM protocol (outside MS internal documents, I presume)
- Ruby/NTLM - A pure Ruby implementation of the NTLM protocol. Again, not used in this project but invaluable for decoding NTLM messages and figuring out what SSPI was returning.
- Seamonkey/Mozilla NTLM implementation - The only source for an implementation in an actual browser. How they figured out how to use SSPI themselves is beyond me.
