NTLM认证proxy的认证流程

The NTLM HTTP proxy authentication mechanism works as follows:

1.The client sends a connect command to the proxy server:
    CONNECT 172.16.49.20:443 HTTP/1.0

2.The proxy server responds with a 407 status, indicating that the client must

authenticate. "NTLM" is presented as a supported authentication mechanism via the

"Proxy-Authenticate" header. Typically, the server closes the connection at this time:
    HTTP/1.1 407 Proxy Authentication Required
    Proxy-Authenticate: NTLM
    Connection: close

3.The client resubmits the request with an "Proxy-Authorization" header containing a

Type 1 message parameter. The Type 1 message is Base-64 encoded for transmission. From

this point forward, the connection is kept open; closing the connection requires

reauthentication of subsequent requests. This implies that the server and client must

support persistent connections, via either the HTTP 1.0-style "Keep-Alive" header or

HTTP 1.1 (in which persistent connections are employed by default). The relevant

request headers appear as follows (the line break in the "Proxy-Authorization" header

below is for display purposes only, and is not present in the actual message):
    CONNECT 172.16.49.20:443 HTTP/1.0
    Proxy-Authorization: NTLM TlRMTVNTUAABAAAABzIAAAYABgArAAAACwALACAAAABXT1
    JLU1RBVElPTkRPTUFJTg==

4.The proxy server replies with a 407 status containing a Type 2 message in the "Proxy

-Authenticate" header (again, Base-64 encoded). This is shown below (the line breaks in

the "WWW-Authenticate" header are for editorial clarity only, and are not present in

the actual header).
    HTTP/1.1 407 Proxy Authentication Required
    Proxy-Authenticate: NTLM TlRMTVNTUAACAAAADAAMADAAAAABAoEAASNFZ4mrze8
    AAAAAAAAAAGIAYgA8AAAARABPAE0AQQBJAE4AAgAMAEQATwBNAEEASQBOAAEADABTA
    EUAUgBWAEUAUgAEABQAZABvAG0AYQBpAG4ALgBjAG8AbQADACIAcwBlAHIAdgBlAHI
    ALgBkAG8AbQBhAGkAbgAuAGMAbwBtAAAAAAA=

5.The client responds to the Type 2 message by resubmitting the request with an

"Authorization" header containing a Base-64 encoded Type 3 message (again, the line

breaks in the "Authorization" header below are for display purposes only):
    CONNECT 172.16.49.20:443 HTTP/1.0
    Proxy-Authorization: NTLM TlRMTVNTUAADAAAAGAAYAGoAAAAYABgAggAAAAwADABAAA
    AACAAIAEwAAAAWABYAVAAAAAAAAACaAAAAAQIAAEQATwBNAEEASQBOAHUAcwBlAHIA
    VwBPAFIASwBTAFQAQQBUAEkATwBOAMM3zVy9RPyXgqZnr21CfG3mfCDC0+d8ViWpjB
    wx6BhHRmspst9GgPOZWPuMITqcxg==

6.Finally, the server validates the responses in the client's Type 3 message and allows

access to the resource.
    HTTP/1.1 200 OK