NTLM authentication fails with .NET 6 (LDAP error 53), succeeds with .NET 4.7.2

Question

In the client we are using the HttpClient with the UseDefaultCredentials option to authenticate against a Node.js server running express-nltm. The authentication is done using NTLM and express-nltm is communicating with an Active Directory server over LDAPS.

The client is compiled against .NET Standard 2.0. If .NET 4.7.2 is used as runtime everything works fine. However, if the same assembly is executed with .NET 6.0.4 the authentication fails since the the Active Directory server returns the error code 53 - unwilling to perform.

The authentication fails at the last step of the NTLM flow. It may be relevant that the first 58 bytes of the Authorization header sent by the client are equal for .NET 4.7.2 and .NET 6 except for bytes 51 and 53, so something seems to be done differently by .NET 6 in comparison to .NET 4.7.2. Additionally, the issue only occurs if the communication to the Active Directory is done over LDAPS. It works fine in case LDAP is used.

	1	2	3	4	5	6	7	8	9	10	11	12	13	14	15	16	17	18	19	20	21	22	23	24
.NET 4.7.2	78	84	76	77	83	83	80	0	3	0	0	0	24	0	24	0	130	0	0	0	24	0	24	0
.NET 6	78	84	76	77	83	83	80	0	3	0	0	0	24	0	24	0	130	0	0	0	24	0	24	0

	25	26	27	28	29	30	31	32	33	34	35	36	37	38	39	40	41	42	43	44	45	46	47	48
.NET 4.7.2	154	0	0	0	20	0	20	0	88	0	0	0	6	0	108	0	0	0	16	0	16	0	114	0
.NET 6	154	0	0	0	20	0	20	0	88	0	0	0	6	0	108	0	0	0	16	0	16	0	114	0

	49	50	51	52	53	54	55	56	57	58
.NET 4.7.2	0	0	0	0	0	0	178	0	0	0
.NET 6	0	0	16	0	16	0	178	0	0	0

So the questions would be

Has anything changed in the NTLM implementation between .NET 4.7.2 and .NET 6?
What is the significance of bytes 51 and 53 in the Authorization header?

NTLM authentication fails with .NET 6 (LDAP error 53), succeeds with .NET 4.7.2

0 Answers