Suds投擲403在SharePoint上禁止

我在使用python-ntlm包對SharePoint 2010站點進行身份驗證時遇到問題。我嘗試了this thread鏈接的解決方案，但沒有運氣。Suds投擲403在SharePoint上禁止

我正在運行Python 2.7.10，泡沫0.4和python-ntlm 1.1.0。

這裏是我的代碼：

from suds.client import * 
from suds.transport.https import WindowsHttpAuthenticated 

import logging 
logging.basicConfig(level=logging.INFO) 
logging.getLogger('suds.client').setLevel(logging.DEBUG) 
logging.getLogger('suds.transport').setLevel(logging.DEBUG) 
logging.getLogger('ntlm').setLevel(logging.DEBUG) 

url = "https://web.site.com/sites/Collection/_vti_bin/Lists.asmx?WSDL" 
ntlm = WindowsHttpAuthenticated(username='DOMAIN\UserName', 
           password='Password') 
client = Client(url, transport=ntlm) 
client.service.GetListCollection()

這裏的調試輸出：

DEBUG:suds.transport.http:opening (https://web.site.com/sites/Collection/_vti_bin/Lists.asmx?WSDL) 
DEBUG:suds.transport.http:opening (http://www.w3.org/2001/XMLSchema.xsd) 
DEBUG:suds.transport.http:opening (http://www.w3.org/2001/xml.xsd) 
DEBUG:suds.client:sending to (https://web.site.com/sites/Collection/_vti_bin/Lists.asmx) 
message: 
<?xml version="1.0" encoding="UTF-8"?> 
<SOAP-ENV:Envelope xmlns:ns0="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ns1="http://schemas.microsoft.com/sharepoint/soap/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"> 
    <SOAP-ENV:Header/> 
    <ns0:Body> 
     <ns1:GetListCollection/> 
    </ns0:Body> 
</SOAP-ENV:Envelope> 
DEBUG:suds.client:headers = {'SOAPAction': u'"http://schemas.microsoft.com/sharepoint/soap/GetListCollection"', 'Content-Type': 'text/xml; charset=utf-8'} 
DEBUG:suds.transport.http:sending: 
URL:https://web.site.com/sites/Collection/_vti_bin/Lists.asmx 
HEADERS: {'SOAPAction': u'"http://schemas.microsoft.com/sharepoint/soap/GetListCollection"', 'Content-Type': 'text/xml; charset=utf-8', 'Content-type': 'text/xml; charset=utf-8', 'Soapaction': u'"http://schemas.microsoft.com/sharepoint/soap/GetListCollection"'} 
MESSAGE: 
<?xml version="1.0" encoding="UTF-8"?><SOAP-ENV:Envelope xmlns:ns0="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ns1="http://schemas.microsoft.com/sharepoint/soap/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"><SOAP-ENV:Header/><ns0:Body><ns1:GetListCollection/></ns0:Body></SOAP-ENV:Envelope> 
ERROR:suds.client:<?xml version="1.0" encoding="UTF-8"?> 
<SOAP-ENV:Envelope xmlns:ns0="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ns1="http://schemas.microsoft.com/sharepoint/soap/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"> 
    <SOAP-ENV:Header/> 
    <ns0:Body> 
     <ns1:GetListCollection/> 
    </ns0:Body> 
</SOAP-ENV:Envelope> 
DEBUG:suds.client:http failed: 
403 FORBIDDEN 
Traceback (most recent call last): 
    File "C:/Users/username/PycharmProjects/Suds/soap.py", line 14, in <module> 
    client.service.GetListCollection() 
    File "C:\Python27\lib\site-packages\suds\client.py", line 542, in __call__ 
    return client.invoke(args, kwargs) 
    File "C:\Python27\lib\site-packages\suds\client.py", line 602, in invoke 
    result = self.send(soapenv) 
    File "C:\Python27\lib\site-packages\suds\client.py", line 649, in send 
    result = self.failed(binding, e) 
    File "C:\Python27\lib\site-packages\suds\client.py", line 708, in failed 
    raise Exception((status, reason)) 
Exception: (403, u'Forbidden')

然而，等效工作完全正常的捲曲（格式化的可讀性）

curl -u 'Username':'Password' --ntlm -X POST \ 
-H 'Content-Type: text/xml'\ 
-H 'SOAPAction: "http://schemas.microsoft.com/sharepoint/soap/GetListCollection"' \ 
"https://web.site.com/sites/Collection/_vti_bin/Lists.asmx" \ 
--data-binary @soapenvelope.xml

我也一直未能找到一種辦法來強制泡沫通過Fiddler代理，同時也通過NTLM a uthentication。概述here，它似乎無視任何代理設置，並且我無法找到一種方法通過提琴手和混合和匹配本地代理，讓它嘗試對列表web服務進行NTLM身份驗證。

環境信息（使這種易於搜索）：

的SharePoint 2010
基於表單的認證/ FedAuth
外部Oracle SSO使用SAML 1.x版

來源

2015-09-18 Taylor

一個good amount of reading for the NTLM protocol後，我發現cURL正在發送第一個請求上的NTLM類型1消息。然而，泡沫（和PowerShells'New-WebServiceProxy）沒有這樣做。它得到了403禁止，但沒有進行握手過程，因爲這是意想不到的。使用python-ntlm3中的create_NTLM_NEGOTIATE_MESSAGE()，我能夠生成該類型1消息。

通過添加類型1消息的「授權」標頭，強制401未授權，並導致WindowsHttpAuthenticated按預期完成握手。

from ntlm3 import ntlm 
from suds.client import Client 
from suds.transport.https import WindowsHttpAuthenticated 

url = "https://web.site.com/sites/Collection/_vti_bin/Lists.asmx" 
wsdl = (url + "?WSDL") 
domain = 'DOM' 
username = 'USER' 
password = 'PASS' 

transport = WindowsHttpAuthenticated(username=username, 
            password=password) 
client = Client(url=wsdl, 
       location=url, 
       transport=transport) 

negotiate = "%s\\%s" % (domain, username) 
ntlmauth = 'NTLM %s' % ntlm.create_NTLM_NEGOTIATE_MESSAGE(negotiate).decode('ascii') 
header = {'Authorization': ntlmauth} 
client.set_options(headers=header) 
client.service.GetList('Test')

所有這一切發生的神奇原因是因爲我們使用基於窗體的身份驗證（FBA）。正常的身份驗證請求被路由到Oracle SSO，這就是爲什麼（我相信）它沒有正常響應並導致403未授權。

希望這有助於防止某人將頭撞向牆壁。

來源

2015-09-21 18:25:19 Taylor

Suds投擲403在SharePoint上禁止

回答

相關問題