Set WSMAN_OPTION_UNENCRYPTED_MESSAGES when Basic auth is used over HTTP #6706
Conversation
…auth is used with HTTP
| SetWSManSessionOption(WSManNativeApi.WSManSessionOption.WSMAN_OPTION_USE_SSL, 1); | ||
| } | ||
| if (connectionInfo.NoEncryption) | ||
| if (connectionInfo.NoEncryption || |
There was a problem hiding this comment.
After thinking about this I am uncomfortable making PSRP messages non-encrypted by default for Basic auth. Basic auth is not recommended but I am sure many customers use it, and may rely on PSRP messages being encrypted.
There was a problem hiding this comment.
@PaulHigin: I limited the change to UNIX. PSRP/MI don't support encryption over HTTP like PSRP/WIndows/WSMan does.
|
FYI: The -workingdirectory test failure is being addressed with PR #6723 |
…encryption on Windows.
|
I'm concerned about this being enabled by default on Unix. On Windows, the user needs to enable |
SteveL-MSFT
left a comment
SteveL-MSFT
left a comment
There was a problem hiding this comment.
This should be explicitly opt-in
|
@SteveL-MSFT : What do you mean by explicitly opt-in? Right now, it's not possible at all from Linux because flags are not set appropriately. of course, it's till not possible from Linux to Windows without configuring the WSMan settings appropriately. Are you suggesting that we replace the -UseSLL and have -AllowUnencrypted? |
|
@dantraMSFT not replace, but perhaps add that switch |
|
On Linux, encryption over HTTP is simply not supported and we would need to introduce a breaking change to require an explicit opt-in. I think there's one of three approaches 1: The user would have to explicitly select -UseSSL or -AllowUnencrypted since selecting need is an unsupported state. 2: -UseSSL would need to be the default behavior. 3: Change OMI to have a policy that needs to be explicitly enabled, such as we have with WSMan::localhost\Service\AllowUnencrypted. |
|
encryption over HTTP is only supported with Kerberos, NTML and CredSSP (the last one not supported on Linux) |
|
Closing due to #6787 (Disallow Basic Auth over HTTP on Unix) |
4 participants
PR Summary
This changes ensure WSMAN_OPTION_UNENCRYPTED_MESSAGES is set when using Basic auth over HTTP. On Linux and macOS, not setting this option explicitly fails the connection request.
PR Checklist
.h,.cpp,.cs,.ps1and.psm1files have the correct copyright headerWIP:to the beginning of the title and remove the prefix when the PR is ready.[feature]if the change is significant or affects feature tests