Subject: Re: AW: Need feedback on new Mini-Redirector tutorial

From: Wilfred <[email-masked]>
Date: Fri, 22 Jun 2007 09:24:15 -0700

> At my systems (Win XP), I was not able to use the mini-redirector 
(net use *
 > ) so far. When I connect to WebDAV servers, I do not get a drive letter.
 > Except I use WebDrive, or something like that. But not by using Office,
 > Internet Explorer (open as web folder) or Windows Explorer (Add Network
 > Resource).

I had never tested this before so I started a WebDAV server on my PC.
I then mounted a drive by using: net use y: http://localhost/dav/c/

I browsed to a Word document on y: and opened the document by double 
clicking it. I then immediately got another login prompt from Word, 
meaning that Word was not directly using the network drive, but was 
instead directly accessing the WebDAV resource. I am not sure how this 
is possible. Word must somehow notice that the drive is a WebDAV resource?

After opening the document, I inspected the document directly from my 
hard drive, and the name was not changed, nor were there any backup 
files. However, in the mapped network drive, the word document was 
changed to:
mydoc.docopaquelocktoken:009e3268-467b-eda4-a765-00a0c91e6bf9

Maybe Microsoft tools auto detects a mini redirector mapped drive and 
directly open files as WebDAV resources?

I have not seen this behavior using other tools, which simply opens the 
document as if the drive is a normal hard drive.

-W

---

From: Wilfred Nilsen <[email-masked]>
Date: Mon, 25 Jun 2007 17:29:32 +0200

> On > http://barracudaserver.com/products/BarracudaDrive/tutorials/mini_redirector.html > there seems to be a major error concerning security and authentication. > > It is the *server* that decides whether it accepts authentication or not.

You are probably right in an ideal world, but the software
will not be good at interoperating unless you accept both Basic and Digest. In
addition, one must also accept the incorrect domain name added by Microsoft
WebDAV clients. 

>So by default, if the connection is not TLS-secured, a
server MUST NOT 
>accept Basic Authentication, and it MUST NOT ask the client for Basic 

What good is this if a client sends a Basic authentication
header anyway? The damage has already happened and any eavesdropper can extract
the username and password the client sent.-W

_________________________________________________________________
Express yourself instantly with MSN Messenger! Download today it's FREE!
http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

---

From: Wilfred Nilsen <[email-masked]>
Date: Fri, 29 Jun 2007 02:38:36 +0200

> About 10 to 15 years ago old browser forced
HTTP-servers to offer Basic 
> Authentication. Today mostly broken and badly configured servers force 
> good willing clients into Basic Authentication.

I think you missed my point. We are not forcing the client
to use Basic authentication. We are giving clients that do not support Digest
authentication the option of using Basic. Clients that support Digest use
Digest authentication.

> Is there any client, that sends Basic Authentication Headers without 
> beeing asked for by the server? Please tell me.

 The reason we made a special authenticator for WebDAV was to
make it interoperate with a number of clients we initially had problems with.
We did this test 18 months ago, but we unfortunately did not keep a log of the
clients we had problems with.

-W