Repository navigation
Correct the Basic-auth docs: Windows accepts bare local account names only - #173
Merged
Merged
Conversation
… only (#172) Tested against a real Windows host (2008 R2, Basic=true, HTTPS): the WinRM service accepts Basic for LOCAL accounts only, addressed by their bare user name. A domain account is rejected, and so is a local account written as MACHINE\user - the same valid credential that succeeds bare gets a 401 once qualified. The docs and CHANGELOG claimed the opposite ("a domain-qualified name keeps its domain prefix, which is how the server locates the account"), so correct authentication.md (including its DOMAIN\Administrator example, which cannot work against Windows), cli.md, preparing-the-host.md, migrating-from-winrm4j.md, the CHANGELOG bullet, and the two code comments repeating the claim. The client still sends a qualified name verbatim, for non-Microsoft WSMan services that accept one. Also note in authentication.md that every server-side Basic refusal (qualified or domain account, Basic disabled, unencrypted HTTP) surfaces as the same 401, indistinguishable from a wrong password. Fixes #172 Co-Authored-By: Claude Fable 5 <[email protected]>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0d91c3c61e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…view) Over plain HTTP with AllowUnencrypted=false, the service may authenticate the Basic credential and then reject the unprotected SOAP with an HTTP 500 WSMan fault, which this client surfaces as a fault, not an authentication error. A 401 was what the real-host test observed on Server 2008 R2, so keep both outcomes in the note instead of grouping the misconfiguration with credential rejections. Co-Authored-By: Claude Fable 5 <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #172.
Real-host testing (Windows Server 2008 R2,
Basic=trueon the service, HTTPS transport) shows the 2.2.00 Basic-authentication docs are wrong about accounts: the WinRM service accepts Basic for local accounts only, addressed by their bare user name. A domain account is rejected, and so is a local account written asMACHINE\user— the same valid credential that succeeds bare gets a 401 once qualified. The docs and CHANGELOG claimed the opposite ("a domain-qualified user name keeps its domain prefix on the wire; the server locates the account by it").Docs-and-comments-only change:
authentication.md: the Basic section now states the local-accounts/bare-name constraint (and the example usescredentials("Administrator", …)instead of the domain-qualified form, which cannot work against Windows); adds a note that every server-side Basic refusal — qualified or domain account,Basicdisabled, unencrypted HTTP — surfaces as the same 401, indistinguishable from a wrong password.cli.md,preparing-the-host.md,migrating-from-winrm4j.md: same correction, one sentence each.BasicAuthScheme/LightWinRMService: the two code comments repeating the claim corrected. No behavior change — the client still sends a qualified name verbatim, for non-Microsoft WSMan services that accept one.mvn verify sitegreen: 235 tests pass, 0 Checkstyle/PMD/SpotBugs findings.🤖 Generated with Claude Code