NTLM Authentication for WSO2 EI

13 min readAug 21, 2018

NT LAN Manager (NTLM) is a security protocol by Microsoft that provides authentication, integrity, and confidentiality to users. It is the successor of the Microsoft LAN Manager (LANMAN) authentication protocol and attempts to provide backward compatibility with LANMAN. This post describes how to use the NTLM authentication to invoke a backend service through WSO2 EI v6.2.0.

CONTENT

Enabling IIS and Windows Authentication.
Setting up NTLM service in Windows.
i. Setting up the backend service for the IIS Manager.
ii. Enabling NTLM service in the backend.
-NTLM v1
- NTLM v2
NTLM authentication for the backend call through EI v6.2.0.
References

1. Enabling IIS and Windows Authentication

In order to enable IIS, open the ‘Turn Windows features on or off’ from Control Panel-> Programs and Features -> Turn Windows features on or off. Then select ‘Internet Information Services’ as in the image 1. You can find the Windows Authentication feature under the ‘Security’. Also, make sure you install required ASP.NET versions too.

2. Setting up NTLM service in Windows

Here I’m going to host a sample WCF service which was created using C#. You can download the service from the below link.
https://drive.google.com/open?id=1HRQaTQTnavruRMsq-BTkm7HdQNCW33eR

i. Setting up the backend service for the IIS Manager

Open the ‘Internet Information Service (IIS) Manager’. You can find this by just searching for the name using the windows searching facility at the taskbar Then select ‘Add Website’ option by right click on the ‘Sites’ folder.

From the opened window,

Give a site name
Select the .NET framework
Select the physical path to the service
Fill other details as necessary.

Select OK to finalize the changes.

You can check whether the service is working by downloading and opening the service using Visual Studio and running the service using the Run button in the IDE.

You will get a similar window as below first.

Then, select the ‘Service1.svc’. If the service is running properly you will see a similar window to the below image 4.

ii. Enabling NTLM service in the backend

Then select the added service under the Sites folder in the currently opened IIS Manager window and enable Windows Authentication. Then select the ‘Providers’ option which appears at the right side of the window and makes the NTLM option as the first choice by make it moving up.

For both NTLM versions, first, you have to open the ‘Local Security Policy’ window. Then select Security Options from Security Settings-> Local Policies-> Security Options.

NTLM v1

For NTLM v1 select the ‘Network security: LAN Manager authentication level’ and set the value to ‘Send LM & NTLM responses’.

NTLM v2

NTLM v2 requires few more configurations than its v1.

a. From ‘Local Security Policy-> Security Settings-> Local Policies-> Security Options’, select the ‘Network security: LAN Manager authentication level’ and set the value to ‘Send NTLMv2 response only. Refuse LM & NTLM’ option.

b. From the same window, select ‘Network security: Minimum session security for NTLM SSP based (including secure RPC) clients’ and then set ‘Require NTLMv2 session security’.

c. Select ‘Network security: Minimum session security for NTLM SSP based (including secure RPC) servers’ and set ‘NTLMv2 session security’.

3. NTLM authentication for the backend call through EI v6.2.0

Pre-requisites: EI 6.2.0 instance

After getting a working EI instance, follow the below steps to set up the EI for NTLM authentication.

i. Download the Custom NTLM Mediator from source code from the following link.
https://drive.google.com/open?id=1JK413QtNmHkCVjuTc8w2cd-BXlrbQ24h

ii. Copy the ‘CustomNTMLMediator-1.0.0.jar’ which resides in CustomNTMLMediator/ target folder into <EI-HOME>/dropins folder. (It might be required to build the project again in your environment)

iii. Restart the EI instance.

iv. Create a sample proxy service as below.

<?xml version=”1.0" encoding=”UTF-8"?>
<proxy xmlns=”http://ws.apache.org/ns/synapse" 
 name=”NTLMProxy”
 startOnLoad=”true”
 statistics=”disable”
 trace=”disable”
 transports=”http,https”>
<target>
  <inSequence>    <class name=”com.custom.ntlm.NTLMMediator”>
      <property name=”username” value=”Nipuna”/>
      <property name=”host” value=”localhost”/>
      <property name=”ntlmVersion” value=”v2"/>
      <property name=”domain” value=”DESKTOP-0RT7HLD”/>
      <property name=”password” value=”nipuna”/>
    </class>

    <class name=”com.custom.ntlm.NTLMCalloutMediator”>
      <property name=”serviceURL” value=”http://localhost:54784/Service1.svc"/>
      <property name=”initAxis2ClientOptions” value=”false”/>
      <property name=”action”
value=”http://tempuri.org/IService1/ResponseFromBackend"/>
    </class>    <header action=”remove” name=”To”/>
    <property name=”RESPONSE” scope=”default” type=”STRING” value=”true”/>
    <property action=”remove” name=”NO_ENTITY_BODY” scope=”axis2"/>
    <send/>
  </inSequence>
</target>
<description/>
</proxy>

Please be noted that the property values such as username, host, domain, password, serviceURL and etc can be different in your case.

v. Invoke the API using the following request using a tool like SoapUI.

<soapenv:Envelope xmlns:soapenv=”http://schemas.xmlsoap.org/soap/envelope/" xmlns:tem=”http://tempuri.org/">
  <soapenv:Header/>
  <soapenv:Body>
    <tem:ResponseFromBackend/>
  </soapenv:Body>
</soapenv:Envelope>

You can find the corresponding endpoint by listing the available services and navigating into the required proxy service name. You will see a page as below.

If all the things happen correctly you will receive a similar response to below.

<soapenv:Envelope xmlns:soapenv=”http://schemas.xmlsoap.org/soap/envelope/" xmlns:tem=”http://tempuri.org/">
  <soapenv:Header/>
  <soapenv:Body>
    <ResponseFromBackendResponse xmlns=”http://tempuri.org/">            
      <ResponseFromBackendResult>Response from the Backend</ResponseFromBackendResult>
    </ResponseFromBackendResponse>
  </soapenv:Body>
</soapenv:Envelope>

In the terminal, you will see similar log lines for a successful service call

[2018–08–21 10:31:45,461] [] DEBUG — wire HTTP-Listener I/O dispatcher-1 >> “POST /services/NTLMProxy HTTP/1.1[\r][\n]” 
[2018–08–21 10:31:45,862] [] DEBUG — wire HTTP-Listener I/O dispatcher-1 >> “Accept-Encoding: gzip,deflate[\r][\n]” 
[2018–08–21 10:31:45,889] [] DEBUG — wire HTTP-Listener I/O dispatcher-1 >> “Content-Type: text/xml;charset=UTF-8[\r][\n]” [2018–08–21 10:31:45,894] [] DEBUG — wire HTTP-Listener I/O dispatcher-1 >> “SOAPAction: “urn:mediate”[\r][\n]” 
[2018–08–21 10:31:45,898] [] DEBUG — wire HTTP-Listener I/O dispatcher-1 >> “Content-Length: 219[\r][\n]” 
[2018–08–21 10:31:45,970] [] DEBUG — wire HTTP-Listener I/O dispatcher-1 >> “Host: DESKTOP-0RT7HLD:8280[\r][\n]” 
[2018–08–21 10:31:45,994] [] DEBUG — wire HTTP-Listener I/O dispatcher-1 >> “Connection: Keep-Alive[\r][\n]” 
[2018–08–21 10:31:46,048] [] DEBUG — wire HTTP-Listener I/O dispatcher-1 >> “User-Agent: Apache-HttpClient/4.1.1 (java 1.5)[\r][\n]” 
[2018–08–21 10:31:46,116] [] DEBUG — wire HTTP-Listener I/O dispatcher-1 >> “[\r][\n]” 
[2018–08–21 10:31:46,122] [] DEBUG — wire HTTP-Listener I/O dispatcher-1 >> “<soapenv:Envelope xmlns:soapenv=”http://schemas.xmlsoap.org/soap/envelope/” xmlns:tem=”http://tempuri.org/”>[\n]” 
[2018–08–21 10:31:46,309] [] DEBUG — wire HTTP-Listener I/O dispatcher-1 >> “ <soapenv:Header/>[\n]” 
[2018–08–21 10:31:46,398] [] DEBUG — wire HTTP-Listener I/O dispatcher-1 >> “ <soapenv:Body>[\n]” 
[2018–08–21 10:31:46,421] [] DEBUG — wire HTTP-Listener I/O dispatcher-1 >> “ <tem:ResponseFromBackend/>[\n]” 
[2018–08–21 10:31:46,505] [] DEBUG — wire HTTP-Listener I/O dispatcher-1 >> “ </soapenv:Body>[\n]” 
[2018–08–21 10:31:46,508] [] DEBUG — wire HTTP-Listener I/O dispatcher-1 >> “</soapenv:Envelope>” 
[2018–08–21 10:31:46,520] [] DEBUG — headers http-incoming-2 >> POST /services/NTLMProxy HTTP/1.1 
[2018–08–21 10:31:46,534] [] DEBUG — headers http-incoming-2 >> Accept-Encoding: gzip,deflate 
[2018–08–21 10:31:46,540] [] DEBUG — headers http-incoming-2 >> Content-Type: text/xml;charset=UTF-8 
[2018–08–21 10:31:46,548] [] DEBUG — headers http-incoming-2 >> SOAPAction: “urn:mediate” 
[2018–08–21 10:31:46,553] [] DEBUG — headers http-incoming-2 >> Content-Length: 219 
[2018–08–21 10:31:46,583] [] DEBUG — headers http-incoming-2 >> Host: DESKTOP-0RT7HLD:8280 
[2018–08–21 10:31:46,600] [] DEBUG — headers http-incoming-2 >> Connection: Keep-Alive 
[2018–08–21 10:31:46,606] [] DEBUG — headers http-incoming-2 >> User-Agent: Apache-HttpClient/4.1.1 (java 1.5) 
[2018–08–21 10:31:46,655] [] DEBUG — NTLMCalloutMediator [NTLMCalloutMediator] mediate method Invoked. 
[2018–08–21 10:31:46,806] [] DEBUG — NTLMCalloutMediator [NTLMCalloutMediator] Message : <?xml version=’1.0' encoding=’utf-8'?><soapenv:Envelope xmlns:soapenv=”http://schemas.xmlsoap.org/soap/envelope/” xmlns:tem=”http://tempuri.org/”><soapenv:Body> <tem:ResponseFromBackend/> </soapenv:Body></soapenv:Envelope> [2018–08–21 10:31:46,965] [] INFO — NTLMCalloutMediator Inside Mediator initClientoption : false 
[2018–08–21 10:31:46,972] [] DEBUG — NTLMCalloutMediator [NTLMCalloutMediator] About to invoke service : http://localhost:54784/Service1.svc with action : http://tempuri.org/IService1/ResponseFromBackend 
[2018–08–21 10:31:46,996] [] DEBUG — NTLMCalloutMediator [NTLMCalloutMediator] Request message payload : <tem:ResponseFromBackend xmlns:tem=”http://tempuri.org/”/> 
[2018–08–21 10:31:47,014] [] DEBUG — header >> “POST /Service1.svc HTTP/1.1[\r][\n]” 
[2018–08–21 10:31:47,022] [] DEBUG — header >> “Content-Type: text/xml; charset=UTF-8[\r][\n]” 
[2018–08–21 10:31:47,032] [] DEBUG — header >> “SOAPAction: “http://tempuri.org/IService1/ResponseFromBackend"[\r][\n]" 
[2018–08–21 10:31:47,046] [] DEBUG — header >> “User-Agent: Axis2[\r][\n]” 
[2018–08–21 10:31:47,049] [] DEBUG — header >> “Host: localhost:54784[\r][\n]” 
[2018–08–21 10:31:47,061] [] DEBUG — header >> “Content-Length: 220[\r][\n]” 
[2018–08–21 10:31:47,067] [] DEBUG — header >> “[\r][\n]” 
[2018–08–21 10:31:47,070] [] DEBUG — content >> “<?xml version=’1.0' encoding=’UTF-8'?><soapenv:Envelope xmlns:soapenv=”http://schemas.xmlsoap.org/soap/envelope/”><soapenv:Body><tem:ResponseFromBackend xmlns:tem=”http://tempuri.org/”/></soapenv:Body></soapenv:Envelope>” [2018–08–21 10:31:47,461] [] DEBUG — header << “HTTP/1.1 200 OK[\r][\n]” 
[2018–08–21 10:31:47,493] [] DEBUG — header << “HTTP/1.1 200 OK[\r][\n]” 
[2018–08–21 10:31:47,495] [] DEBUG — header << “Cache-Control: private[\r][\n]” 
[2018–08–21 10:31:47,499] [] DEBUG — header << “Content-Type: text/xml; charset=utf-8[\r][\n]” 
[2018–08–21 10:31:47,512] [] DEBUG — header << “Server: Microsoft-IIS/10.0[\r][\n]” 
[2018–08–21 10:31:47,517] [] DEBUG — header << “X-AspNet-Version: 4.0.30319[\r][\n]” 
[2018–08–21 10:31:47,530] [] DEBUG — header << “X-SourceFiles: =?UTF-8?B?QzpcVmlzdWFsIFN0dWRpb1xXY2ZTZXJ2aWNlXFdjZlNlcnZpY2VcU2VydmljZTEuc3Zj?=[\r][\n]” 
[2018–08–21 10:31:47,545] [] DEBUG — header << “X-Powered-By: ASP.NET[\r][\n]” 
[2018–08–21 10:31:47,548] [] DEBUG — header << “Date: Tue, 21 Aug 2018 17:31:47 GMT[\r][\n]” 
[2018–08–21 10:31:47,561] [] DEBUG — header << “Content-Length: 261[\r][\n]” 
[2018–08–21 10:31:47,563] [] DEBUG — header << “[\r][\n]” 
[2018–08–21 10:31:47,568] [] DEBUG — content << “<” 
[2018–08–21 10:31:47,571] [] DEBUG — content << “s:E” 
[2018–08–21 10:31:47,591] [] DEBUG — content << “nvelope xmlns:s=”http://schemas.xmlsoap.org/soap/envelope/”><s:Body><ResponseFromBackendResponse xmlns=”http://tempuri.org/”><ResponseFromBackendResult>Response from the Backend</ResponseFromBackendResult></ResponseFromBackendResponse></s:Body></s:Envelope>” 
[2018–08–21 10:31:47,668] [] DEBUG — NTLMCalloutMediator [NTLMCalloutMediator] Response payload received : <ResponseFromBackendResponse xmlns=”http://tempuri.org/”><ResponseFromBackendResult>Response from the Backend</ResponseFromBackendResult></ResponseFromBackendResponse> [2018–08–21 10:31:47,770] [] DEBUG — NTLMCalloutMediator [NTLMCalloutMediator] mediate method invocation END. 
[2018–08–21 10:31:47,820] [] DEBUG — headers http-incoming-2 << HTTP/1.1 200 OK 
[2018–08–21 10:31:47,851] [] DEBUG — headers http-incoming-2 << SOAPAction: “urn:mediate” 
[2018–08–21 10:31:47,856] [] DEBUG — headers http-incoming-2 << Host: DESKTOP-0RT7HLD:8280 
[2018–08–21 10:31:47,885] [] DEBUG — headers http-incoming-2 << Accept-Encoding: gzip,deflate 
[2018–08–21 10:31:47,913] [] DEBUG — headers http-incoming-2 << Content-Type: text/xml;charset=UTF-8 
[2018–08–21 10:31:48,055] [] DEBUG — headers http-incoming-2 << Date: Tue, 21 Aug 2018 17:31:47 GMT 
[2018–08–21 10:31:48,086] [] DEBUG — headers http-incoming-2 << Transfer-Encoding: chunked 
[2018–08–21 10:31:48,134] [] DEBUG — headers http-incoming-2 << Connection: Keep-Alive 
[2018–08–21 10:31:48,290] [] DEBUG — wire HTTP-Listener I/O dispatcher-1 << “HTTP/1.1 200 OK[\r][\n]” 
[2018–08–21 10:31:48,652] [] DEBUG — wire HTTP-Listener I/O dispatcher-1 << “SOAPAction: “urn:mediate”[\r][\n]” 
[2018–08–21 10:31:48,674] [] DEBUG — wire HTTP-Listener I/O dispatcher-1 << “Host: DESKTOP-0RT7HLD:8280[\r][\n]” 
[2018–08–21 10:31:48,688] [] DEBUG — wire HTTP-Listener I/O dispatcher-1 << “Accept-Encoding: gzip,deflate[\r][\n]” 
[2018–08–21 10:31:48,733] [] DEBUG — wire HTTP-Listener I/O dispatcher-1 << “Content-Type: text/xml;charset=UTF-8[\r][\n]” [2018–08–21 10:31:48,739] [] DEBUG — wire HTTP-Listener I/O dispatcher-1 << “Date: Tue, 21 Aug 2018 17:31:47 GMT[\r][\n]” 
[2018–08–21 10:31:48,743] [] DEBUG — wire HTTP-Listener I/O dispatcher-1 << “Transfer-Encoding: chunked[\r][\n]” 
[2018–08–21 10:31:48,751] [] DEBUG — wire HTTP-Listener I/O dispatcher-1 << “Connection: Keep-Alive[\r][\n]” 
[2018–08–21 10:31:48,760] [] DEBUG — wire HTTP-Listener I/O dispatcher-1 << “[\r][\n]” 
[2018–08–21 10:31:48,764] [] DEBUG — wire HTTP-Listener I/O dispatcher-1 << “18e[\r][\n]” 
[2018–08–21 10:31:48,770] [] DEBUG — wire HTTP-Listener I/O dispatcher-1 << “<?xml version=’1.0' encoding=’UTF-8'?><soapenv:Envelope xmlns:soapenv=”http://schemas.xmlsoap.org/soap/envelope/” xmlns:tem=”http://tempuri.org/”>[\n]” 
[2018–08–21 10:31:48,784] [] DEBUG — wire HTTP-Listener I/O dispatcher-1 << “ <soapenv:Header/>[\n]” 
[2018–08–21 10:31:48,791] [] DEBUG — wire HTTP-Listener I/O dispatcher-1 << “ <soapenv:Body>[\n]” 
[2018–08–21 10:31:48,795] [] DEBUG — wire HTTP-Listener I/O dispatcher-1 << “ [\n]” 
[2018–08–21 10:31:48,798] [] DEBUG — wire HTTP-Listener I/O dispatcher-1 << “ <ResponseFromBackendResponse xmlns=”http://tempuri.org/”><ResponseFromBackendResult>Response from the Backend</ResponseFromBackendResult></ResponseFromBackendResponse></soapenv:Body>[\n]” 
[2018–08–21 10:31:48,810] [] DEBUG — wire HTTP-Listener I/O dispatcher-1 << “</soapenv:Envelope>[\r][\n]” 
[2018–08–21 10:31:48,814] [] DEBUG — wire HTTP-Listener I/O dispatcher-1 << “0[\r][\n]” 
[2018–08–21 10:31:48,818] [] DEBUG — wire HTTP-Listener I/O dispatcher-1 << “[\r][\n]” 
[2018–08–21 10:32:42,018] [] DEBUG — wire HTTP-Listener I/O dispatcher-1 >> “POST /services/NTLMProxy HTTP/1.1[\r][\n]” 
[2018–08–21 10:32:53,422] [] DEBUG — wire HTTP-Listener I/O dispatcher-1 >> “Accept-Encoding: gzip,deflate[\r][\n]” 
[2018–08–21 10:32:53,426] [] DEBUG — wire HTTP-Listener I/O dispatcher-1 >> “Content-Type: text/xml;charset=UTF-8[\r][\n]” [2018–08–21 10:32:53,446] [] DEBUG — wire HTTP-Listener I/O dispatcher-1 >> “SOAPAction: “urn:mediate”[\r][\n]” 
[2018–08–21 10:32:53,452] [] DEBUG — wire HTTP-Listener I/O dispatcher-1 >> “Content-Length: 219[\r][\n]” 
[2018–08–21 10:32:53,457] [] DEBUG — wire HTTP-Listener I/O dispatcher-1 >> “Host: DESKTOP-0RT7HLD:8280[\r][\n]” 
[2018–08–21 10:32:53,470] [] DEBUG — wire HTTP-Listener I/O dispatcher-1 >> “Connection: Keep-Alive[\r][\n]” 
[2018–08–21 10:32:53,474] [] DEBUG — wire HTTP-Listener I/O dispatcher-1 >> “User-Agent: Apache-HttpClient/4.1.1 (java 1.5)[\r][\n]” 
[2018–08–21 10:32:53,490] [] DEBUG — wire HTTP-Listener I/O dispatcher-1 >> “[\r][\n]” 
[2018–08–21 10:32:53,493] [] DEBUG — wire HTTP-Listener I/O dispatcher-1 >> “<soapenv:Envelope xmlns:soapenv=”http://schemas.xmlsoap.org/soap/envelope/” xmlns:tem=”http://tempuri.org/”>[\n]” 
[2018–08–21 10:32:53,510] [] DEBUG — wire HTTP-Listener I/O dispatcher-1 >> “ <soapenv:Header/>[\n]” 
[2018–08–21 10:32:53,557] [] DEBUG — wire HTTP-Listener I/O dispatcher-1 >> “ <soapenv:Body>[\n]” 
[2018–08–21 10:32:53,570] [] DEBUG — wire HTTP-Listener I/O dispatcher-1 >> “ <tem:ResponseFromBackend/>[\n]” 
[2018–08–21 10:32:53,578] [] DEBUG — wire HTTP-Listener I/O dispatcher-1 >> “ </soapenv:Body>[\n]” 
[2018–08–21 10:32:53,582] [] DEBUG — wire HTTP-Listener I/O dispatcher-1 >> “</soapenv:Envelope>” 
[2018–08–21 10:32:53,601] [] DEBUG — headers http-incoming-3 >> POST /services/NTLMProxy HTTP/1.1 
[2018–08–21 10:32:53,608] [] DEBUG — headers http-incoming-3 >> Accept-Encoding: gzip,deflate 
[2018–08–21 10:32:53,615] [] DEBUG — headers http-incoming-3 >> Content-Type: text/xml;charset=UTF-8 
[2018–08–21 10:32:53,620] [] DEBUG — headers http-incoming-3 >> SOAPAction: “urn:mediate” 
[2018–08–21 10:32:53,658] [] DEBUG — headers http-incoming-3 >> Content-Length: 219 
[2018–08–21 10:32:53,664] [] DEBUG — headers http-incoming-3 >> Host: DESKTOP-0RT7HLD:8280 
[2018–08–21 10:32:53,677] [] DEBUG — headers http-incoming-3 >> Connection: Keep-Alive 
[2018–08–21 10:32:53,682] [] DEBUG — headers http-incoming-3 >> User-Agent: Apache-HttpClient/4.1.1 (java 1.5) 
[2018–08–21 10:32:53,907] [] DEBUG — NTLMCalloutMediator [NTLMCalloutMediator] mediate method Invoked. 
[2018–08–21 10:32:53,958] [] DEBUG — NTLMCalloutMediator [NTLMCalloutMediator] Message : <?xml version=’1.0' encoding=’utf-8'?><soapenv:Envelope xmlns:soapenv=”http://schemas.xmlsoap.org/soap/envelope/” xmlns:tem=”http://tempuri.org/”><soapenv:Body> <tem:ResponseFromBackend/> </soapenv:Body></soapenv:Envelope> 
[2018–08–21 10:32:54,024] [] INFO — NTLMCalloutMediator Inside Mediator initClientoption : false 
[2018–08–21 10:32:54,092] [] DEBUG — NTLMCalloutMediator [NTLMCalloutMediator] About to invoke service : http://localhost:54784/Service1.svc with action : http://tempuri.org/IService1/ResponseFromBackend 
[2018–08–21 10:32:54,183] [] DEBUG — NTLMCalloutMediator [NTLMCalloutMediator] Request message payload : <tem:ResponseFromBackend xmlns:tem=”http://tempuri.org/”/> 
[2018–08–21 10:32:54,299] [] DEBUG — header >> “POST /Service1.svc HTTP/1.1[\r][\n]” 
[2018–08–21 10:32:54,318] [] DEBUG — header >> “Content-Type: text/xml; charset=UTF-8[\r][\n]” 
[2018–08–21 10:32:54,322] [] DEBUG — header >> “SOAPAction: “http://tempuri.org/IService1/ResponseFromBackend”[\r][\n]” 
[2018–08–21 10:32:54,330] [] DEBUG — header >> “User-Agent: Axis2[\r][\n]” 
[2018–08–21 10:32:54,335] [] DEBUG — header >> “Host: localhost:54784[\r][\n]” 
[2018–08–21 10:32:54,341] [] DEBUG — header >> “Content-Length: 220[\r][\n]” 
[2018–08–21 10:32:54,355] [] DEBUG — header >> “[\r][\n]” 
[2018–08–21 10:32:54,357] [] DEBUG — content >> “<?xml version=’1.0' encoding=’UTF-8'?><soapenv:Envelope xmlns:soapenv=”http://schemas.xmlsoap.org/soap/envelope/”><soapenv:Body><tem:ResponseFromBackend xmlns:tem=”http://tempuri.org/”/></soapenv:Body></soapenv:Envelope>” [2018–08–21 10:32:55,285] [] DEBUG — header << “HTTP/1.1 200 OK[\r][\n]” 
[2018–08–21 10:32:55,302] [] DEBUG - header << “HTTP/1.1 200 OK[\r][\n]” 
[2018–08–21 10:32:55,311] [] DEBUG — header << “Cache-Control: private[\r][\n]” 
[2018–08–21 10:32:55,315] [] DEBUG — header << “Content-Type: text/xml; charset=utf-8[\r][\n]” 
[2018–08–21 10:32:55,333] [] DEBUG — header << “Server: Microsoft-IIS/10.0[\r][\n]” 
[2018–08–21 10:32:55,336] [] DEBUG — header << “X-AspNet-Version: 4.0.30319[\r][\n]” 
[2018–08–21 10:32:55,352] [] DEBUG — header << “X-SourceFiles: =?UTF-8?B?QzpcVmlzdWFsIFN0dWRpb1xXY2ZTZXJ2aWNlXFdjZlNlcnZpY2VcU2VydmljZTEuc3Zj?=[\r][\n]” 
[2018–08–21 10:32:55,382] [] DEBUG — header << “X-Powered-By: ASP.NET[\r][\n]” 
[2018–08–21 10:32:55,414] [] DEBUG — header << “Date: Tue, 21 Aug 2018 17:32:55 GMT[\r][\n]” 
[2018–08–21 10:32:55,418] [] DEBUG — header << “Content-Length: 261[\r][\n]” 
[2018–08–21 10:32:55,430] [] DEBUG — header << “[\r][\n]” 
[2018–08–21 10:32:55,453] [] DEBUG — content << “<” 
[2018–08–21 10:32:55,462] [] DEBUG — content << “s:E” 
[2018–08–21 10:32:55,464] [] DEBUG — content << “nvelope xmlns:s=”http://schemas.xmlsoap.org/soap/envelope/”><s:Body><ResponseFromBackendResponse xmlns=”http://tempuri.org/”><ResponseFromBackendResult>Response from the Backend</ResponseFromBackendResult></ResponseFromBackendResponse></s:Body></s:Envelope>” 
[2018–08–21 10:32:55,500] [] DEBUG — NTLMCalloutMediator [NTLMCalloutMediator] Response payload received : <ResponseFromBackendResponse xmlns=”http://tempuri.org/”><ResponseFromBackendResult>Response from the Backend</ResponseFromBackendResult></ResponseFromBackendResponse> [2018–08–21 10:32:55,562] [] DEBUG — NTLMCalloutMediator [NTLMCalloutMediator] mediate method invocation END. 
[2018–08–21 10:32:55,580] [] DEBUG — headers http-incoming-3 << HTTP/1.1 200 OK 
[2018–08–21 10:32:55,602] [] DEBUG — headers http-incoming-3 << SOAPAction: “urn:mediate” 
[2018–08–21 10:32:55,609] [] DEBUG — headers http-incoming-3 << Host: DESKTOP-0RT7HLD:8280 
[2018–08–21 10:32:55,616] [] DEBUG — headers http-incoming-3 << Accept-Encoding: gzip,deflate 
[2018–08–21 10:32:55,618] [] DEBUG — headers http-incoming-3 << Content-Type: text/xml;charset=UTF-8 
[2018–08–21 10:32:55,628] [] DEBUG — headers http-incoming-3 << Date: Tue, 21 Aug 2018 17:32:55 GMT 
[2018–08–21 10:32:55,635] [] DEBUG — headers http-incoming-3 << Transfer-Encoding: chunked 
[2018–08–21 10:32:55,648] [] DEBUG — headers http-incoming-3 << Connection: Keep-Alive 
[2018–08–21 10:32:55,653] [] DEBUG — wire HTTP-Listener I/O dispatcher-1 << “HTTP/1.1 200 OK[\r][\n]” 
[2018–08–21 10:32:55,666] [] DEBUG — wire HTTP-Listener I/O dispatcher-1 << “SOAPAction: “urn:mediate”[\r][\n]” 
[2018–08–21 10:32:55,681] [] DEBUG — wire HTTP-Listener I/O dispatcher-1 << “Host: DESKTOP-0RT7HLD:8280[\r][\n]” 
[2018–08–21 10:32:55,695] [] DEBUG — wire HTTP-Listener I/O dispatcher-1 << “Accept-Encoding: gzip,deflate[\r][\n]” 
[2018–08–21 10:32:55,711] [] DEBUG — wire HTTP-Listener I/O dispatcher-1 << “Content-Type: text/xml;charset=UTF-8[\r][\n]” 
[2018–08–21 10:32:55,732] [] DEBUG — wire HTTP-Listener I/O dispatcher-1 << “Date: Tue, 21 Aug 2018 17:32:55 GMT[\r][\n]” 
[2018–08–21 10:32:55,749] [] DEBUG — wire HTTP-Listener I/O dispatcher-1 << “Transfer-Encoding: chunked[\r][\n]” 
[2018–08–21 10:32:55,764] [] DEBUG — wire HTTP-Listener I/O dispatcher-1 << “Connection: Keep-Alive[\r][\n]” 
[2018–08–21 10:32:55,799] [] DEBUG — wire HTTP-Listener I/O dispatcher-1 << “[\r][\n]” 
[2018–08–21 10:32:55,804] [] DEBUG — wire HTTP-Listener I/O dispatcher-1 << “18e[\r][\n]” 
[2018–08–21 10:32:55,808] [] DEBUG — wire HTTP-Listener I/O dispatcher-1 << “<?xml version=’1.0' encoding=’UTF-8'?><soapenv:Envelope xmlns:soapenv=”http://schemas.xmlsoap.org/soap/envelope/” xmlns:tem=”http://tempuri.org/”>[\n]” 
[2018–08–21 10:32:55,825] [] DEBUG — wire HTTP-Listener I/O dispatcher-1 << “ <soapenv:Header/>[\n]” 
[2018–08–21 10:32:55,870] [] DEBUG — wire HTTP-Listener I/O dispatcher-1 << “ <soapenv:Body>[\n]” 
[2018–08–21 10:32:55,876] [] DEBUG — wire HTTP-Listener I/O dispatcher-1 << “ [\n]” 
[2018–08–21 10:32:55,881] [] DEBUG — wire HTTP-Listener I/O dispatcher-1 << “ <ResponseFromBackendResponse xmlns=”http://tempuri.org/”><ResponseFromBackendResult>Response from the Backend</ResponseFromBackendResult></ResponseFromBackendResponse></soapenv:Body>[\n]” 
[2018–08–21 10:32:55,909] [] DEBUG — wire HTTP-Listener I/O dispatcher-1 << “</soapenv:Envelope>[\r][\n]” 
[2018–08–21 10:32:55,917] [] DEBUG — wire HTTP-Listener I/O dispatcher-1 << “0[\r][\n]” 
[2018–08–21 10:32:55,926] [] DEBUG — wire HTTP-Listener I/O dispatcher-1 << “[\r][\n]”

You can find the CustomNTLMMediator and the Backend service from following links respectively.

NTLM mediator: https://drive.google.com/open?id=1JK413QtNmHkCVjuTc8w2cd-BXlrbQ24h

Backend service: https://drive.google.com/open?id=1HRQaTQTnavruRMsq-BTkm7HdQNCW33eR

Please leave a comment if you got any issue when following the procedure explained by this article.

4. References

NTLM Authentication for WSO2 EI

Written by Nipuna Dilhara