带有ntlm身份验证的curl可以在命令行中工作，但不能在php中工作 - curl with ntlm authentication works in command line but not inside php

curl with ntlm authentication works in command line but not inside php

我必须使用curl从Centos主机连接到IIS。

将curl与--ntlm选项一起使用在命令行上效果良好，但在php中则不然。服务器是Microsoft IIS，第一次回答401未授权，第二次回答200 OK。

经过几个小时的调查，我没有找到一个有效的解决方案。。

当我在命令行（centos6.4）上使用curl来检索服务的内容时：

curl -v http://example.com/do.asmx --ntlm -u DOMAIN''username:password

服务器使用以下代码成功应答：

* About to connect() to example.com port 80 (#0)
*   Trying nn.nn.nn.nn... connected
* Connected to example.com (nn.nn.nn.nn) port 80 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
* Server auth using NTLM with user 'DOMAIN'username'
> GET /do.asmx HTTP/1.1
> Authorization: NTLM xxxxxxxxxxxxxxxxxx
> User-Agent: curl/7.19.7 (i386-redhat-linux-gnu) libcurl/7.19.7 NSS/3.19.1 Basic ECC zlib/1.2.3 libidn/1.18 libssh2/1.4.2
> Host: example.com
> Accept: */*
> 
< HTTP/1.1 401 Unauthorized
< Content-Type: text/html; charset=us-ascii
< Server: Microsoft-HTTPAPI/2.0
< WWW-Authenticate: NTLM xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
< Date: Thu, 07 Jan 2016 19:28:04 GMT
< Content-Length: 341
< 
* Ignoring the response-body
* Connection #0 to host example.com left intact
* Issue another request to this URL: 'http://example.com/do.asmx'
* Re-using existing connection! (#0) with host example.com
* Connected to example.com (nn.nn.nn.nn) port 80 (#0)
* Server auth using NTLM with user 'DOMAIN'username'
> GET /do.asmx HTTP/1.1
> Authorization: NTLM xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
> User-Agent: curl/7.19.7 (i386-redhat-linux-gnu) libcurl/7.19.7 NSS/3.19.1 Basic ECC zlib/1.2.3 libidn/1.18 libssh2/1.4.2
> Host: example.com
> Accept: */*
> 
< HTTP/1.1 200 OK
< Cache-Control: private, max-age=0
< Content-Type: text/html; charset=utf-8
< Server: Microsoft-IIS/7.5
< X-AspNet-Version: 4.0.30319
< Persistent-Auth: true
< X-Powered-By: ASP.NET
< X-UA-Compatible: IE=EmulateIE8
< Date: Thu, 07 Jan 2016 19:28:04 GMT
< Content-Length: 5340
< 

<html>
...

好的，到目前为止，这还可以。现在我试着在php:中做同样的事情

$ch = curl_init();
curl_setopt( $ch, CURLOPT_URL, 'http://example.com/do.asmx' );
curl_setopt( $ch, CURLOPT_HEADER, true );
curl_setopt( $ch, CURLOPT_RETURNTRANSFER, true );
curl_setopt( $ch, CURLOPT_HTTPAUTH, CURLAUTH_NTLM );
curl_setopt( $ch, CURLOPT_USERPWD, "DOMAIN''username:password" );
curl_setopt( $ch, CURLOPT_TIMEOUT, 10 );
curl_setopt( $ch, CURLOPT_VERBOSE, true );

$output = curl_exec($ch);
print_r(curl_getinfo($ch));
echo curl_error($ch);
curl_close($ch);
var_dump($output);

但什么也没发生。结果是

print_r（curl_getinfo（$ch））：

Array
(
    [url] => http://example.com/do.asmx
    [content_type] => 
    [http_code] => 0
    [header_size] => 0
    [request_size] => 0
    [filetime] => -1
    [ssl_verify_result] => 0
    [redirect_count] => 0
    [total_time] => 0
    [namelookup_time] => 0.021611
    [connect_time] => 0
    [pretransfer_time] => 0
    [size_upload] => 0
    [size_download] => 0
    [speed_download] => 0
    [speed_upload] => 0
    [download_content_length] => -1
    [upload_content_length] => -1
    [starttransfer_time] => 0
    [redirect_time] => 0
    [certinfo] => Array
        (
        )
)

回波curl_error（$ch）：

connect() timed out!

var_dump（$output）：

bool(false)

这个问题怎么解决？这超出了我的理解范围。。

我建议您从http标头Authorization: NTLM TL...中删除base64字符串，因为可以对其进行解码并读取您的域和凭据，从而使您面临巨大的安全风险。

也删除那些IP地址，除非它们只是内部的（即使是静态的，也要删除它们）。

首先，我建议您检查您的安全策略。您的防火墙可以阻止某些程序包。