Rust

NTLM Client and Server Code

See more NTLM Examples

Demonstrates the NTLM authentication algorithm for both client and server. Rust

// This example assumes the Chilkat API to have been previously unlocked.
// See Global Unlock Sample for sample code.

let ntlm_client = chilkat::Ntlm::new();
let ntlm_server = chilkat::Ntlm::new();

// The NTLM protocol begins by the client sending the server
// a Type1 message. 
ntlm_client.set_workstation("MyWorkstation");
let type1_msg = ntlm_client.gen_type1().unwrap_or_default();

println!("Type1 message from client to server:");
println!("{}", type1_msg);

// If the server wishes to examine the information embedded within the
// Type1 message, it may call ParseType1. 
// This step is not necessary, it is only for informational purposes..
let type1_info = ntlm_server.parse_type1(&type1_msg).unwrap_or_default();

println!("---");
println!("{}", type1_info);

// The server now generates a Type2 message to be sent to the client.
// The Type2 message requires a TargetName.  A TargetName is
// the authentication realm in which the authenticating account
// has membership (a domain name for domain accounts, or server name
// for local machine accounts).
ntlm_server.set_target_name("myAuthRealm");

let Ok(type2_msg) = ntlm_server.gen_type2(&type1_msg) else {
    println!("{}", ntlm_server.last_error_text());
    return;
};

println!("Type2 message from server to client:");
println!("{}", type2_msg);

// The client may examine the information embedded in the Type2 message 
// by calling ParseType2, which returns XML.  This is only for informational purposes
// and is not required.
let type2_info = ntlm_client.parse_type2(&type2_msg).unwrap_or_default();

println!("---");
println!("{}", type2_info);

// The client will now generate the final Type3 message to be sent to the server.
// This requires the Username and Password:
ntlm_client.set_user_name("test123");
ntlm_client.set_password("myPassword");

let type3_msg = ntlm_client.gen_type3(&type2_msg).unwrap_or_default();
if !ntlm_client.last_method_success() {
    println!("{}", ntlm_client.last_error_text());
    return;
}

println!("Type3 message from client to server:");
println!("{}", type3_msg);

// The server may verify the response by first "loading" the Type3 message.
// This sets the various properties such as Username, Domain, Workstation,
// and ClientChallenge to the values embedded within theType3 message.
// The server may then use the Username to lookup the password.  
// Looking up the password is dependent on your infrastructure.  Perhaps your
// usernames/passwords are stored in a secure database.  If that's the case, you would
// write code to issue a query to get the password string for the given username.
// Once the password is obtained, set the Password property and then 
// generate the Type3 response again.  If the server's Type3 response matches
// the client's Type3 response, then the client's password is correct.

if ntlm_server.load_type3(&type3_msg).is_err() {
    println!("{}", ntlm_server.last_error_text());
    return;
}

// The Username property now contains the username that was embedded within
// the Type3 message.  It can be used to lookup the password.
let client_username = ntlm_server.user_name();

// For this example, we'll simply set the password to a literal string:
ntlm_server.set_password("myPassword");

// The server may generate the Type3 message again, using the client's correct
// password:
let expected_type3_msg = ntlm_server.gen_type3(&type2_msg).unwrap_or_default();

println!("Expected Type3 Message:");
println!("{}", expected_type3_msg);

// If the Type3 message received from the client is exactly the same as the
// expected Type3 message, then the client must've used the same password,
// and authentication is successful.