InfoQ

News

RubySSPI is Big News for Ruby Developers on Windows

Posted by Obie Fernandez on Nov 14, 2006 01:37 PM

Community
Ruby
Topics
Security ,
Programming
Tags
Proxy ,
Firewall ,
RubySSPI ,
NTLM ,
Windows

Rubyist Justin Bailey has just released RubySSPI, which enables NTLM proxy authentication for Ruby on Windows platforms. RubySSPI interacts with Microsoft's Security Support Provider Interface (SSPI) API to enable Ruby programs using Net::HTTP or open-uri to authenticate as the current Windows user with proxy servers requiring NTLM authentication (e.g. Microsoft's ISA). The library provides bindings to the Win32 SSPI libraries, which implement various security protocols for Windows. It was primarily developed to give Negotiate/NTLM proxy authentication abilities to Net::HTTP (and thus, open-uri), similar to support found in Internet Explorer or Firefox.

The library is not an implementation of the NTLM protocol and does not give the ability to authenticate as any given user. It does authenticate with a proxy server as the current user logged into the given Windows workstation where the code is executing. It also does not provide full bindings to the SSPI library, but the author is accepting patches that extend the library in that direction, if anyone is so inclined. An already suggested future enhancement is to leverage RubySSPI to use NTLM authentication with SQL server, removing the need for usernames or passwords in configuration files.

Godsend for some Windows users

If you are behind a proxy that authenticates all traffic, then this library enables your ruby scripts to authenticate with the proxy as the current user seamlessly. This solves the shortcomings of other solutions which require you to enter your username and password in clear text at least once. After a few simple steps, you should be able to successfully install things like Ruby on Rails by simply typying gem install rails, exactly how non-Windows users get to do.

The inability to do gem install was a big mental barrier to adoption in some Microsoft-heavy shops where I've tried to introduce Ruby and Rails. It was also a huge (and constantly recurring) pain for gem commands to fail when I was stuck at a large client with an ISA proxy/firewall. The biggest problem is that a lot of times, nobody at the client site will know anything about the ISA proxy and attempts to figure out why "my Ruby just doesn't work" will meet with confusion, if not outright hostility.

To make RubyGems (gem) commands work seamlessly behind an ISA firewall just download and install the RubySSPI gem manually, and follow the instructions provided in the Readme.txt file inside the distribution.

Related projects

The extraordinarily comprehensive README provided with the RubySSPI gem even includes a useful list of related resources and open-source projects that were used in decoding both NTLM messages and integrating with the SSPI library:

  • Managed SSPI Sample - A .NET implementation of a simple client/server using SSPI. A complex undertaking but provides a great resource for playing with the API.
  • John Lam's RubyCLR - Originally, I used RubyCLR to call into the Managed SSPI sample which really helped me decode what the SSPI interface did and how it worked. I did not end up using that implementation but it was great for research.
  • The NTLM Authentication Protocol - The definitive explanation for the NTLM protocol (outside MS internal documents, I presume)
  • Ruby/NTLM - A pure Ruby implementation of the NTLM protocol. Again, not used in this project but invaluable for decoding NTLM messages and figuring out what SSPI was returning.
  • Seamonkey/Mozilla NTLM implementation - The only source for an implementation in an actual browser. How they figured out how to use SSPI themselves is beyond me.

 

Thanks by Justin Bailey Posted Nov 14, 2006 5:30 PM
How to authenticate within a Rails app? by Michel Löhr Posted Nov 17, 2006 4:13 AM
Re: Thanks by anjan bacchu Posted May 1, 2007 7:56 PM
  1. Back to top

    Thanks

    Nov 14, 2006 5:30 PM by Justin Bailey

    Obie, Thanks for the write up. This library was pretty painful to create but once it was working, it really made my ruby-life a lot easier. Personally, I'd like to see the functionality get pushed into the ruby distribution, but when I posted a patch to the core mailing list the silence was deafening. Hopefully the need will be perceived eventually and it will make it in.

  2. Back to top

    How to authenticate within a Rails app?

    Nov 17, 2006 4:13 AM by Michel Löhr

    I am wondering if I could use this (and how), to authenticate the Windows user within a Rails app. I am missing the link how "NTML sets" the (remote) user in the HTTP request, or otherwise. Any hints appreciated!

  3. Back to top

    Re: Thanks

    May 1, 2007 7:56 PM by anjan bacchu

    Obie, .......... but when I posted a patch to the core mailing list the silence was deafening.
    So, why not try atleast the windows installer group who should be more inclined to listen to you. When I installed ruby on my box, I saw that it contained 6-7 win32 related gems. So, Curt Hibbs or others on the win32 setup team might want to install your stuff by default ? Tbank you, BR, ~A http://anjanb.wordpress.com

Educational Content

Bindings, Platforms, and Innovation

This presentation focuses on the Internet and separating myth from fact, history from the future, and the mundane from the imaginative. Bob Frankston presents a vision of what could and should be.

Orchestrating Long Running Activities with JBoss / JBPM

This article explores the use of JBoss and jBPM to implement design solutions that effectively address the issue of orchestrating long running activities.

Neo4j - The Benefits of Graph Databases

This presentation covers the use of graph databases as an optimal solution for data that is difficult to fit in static tables, rapidly evolving data or data that has a lot of optional attributes.

Realistic about Risk: Software development with Real Options

This session introduces Real Options and shows how it can help in running your project. Real Options is a decision-making process that can be used to manage risk.

Communication Flexibility Using Bindings

This article discusses the use of bindings on services and references (including the instance of non-configured bindings) as the means to implement SCA communications in a Web and SOA environment.

Writing DSLs in Groovy

After a short introduction to DSLs, Scott Davis plays with the keyboard showing how to approach the creation of a DSL by typing working snippets of Groovy code that get executed.

Scaling Agile with C/ALM (Collaborative Application Lifecycle Management)

IBM Rational and InfoQ present, Scaling Agile with C/ALM, an eBook showing organizations how to become “finely tuned software delivery machines” by enabling team integration and scaling.

Concurrent Programming with Microsoft F#

Amanda Laucher presents a real life enterprise application written in F#. She shows actual code snippets, explaining design decisions and suggesting how to use some of the F# constructs.