I will take a look on this to see how it works in my lab and add it to my archives :-)
Original Message:
Sent: Tue March 04, 2025 09:29 AM
From: Jakub Nejdl
Subject: ISVDI - cifs integration - best practice
So finally I have something like this. This is just a simple SDI function for smb authentication using smbj AuthContext and reading a shared file. Of course it needs to be modified for use in RMI, but maybe someone will use it:
importPackage(Packages.com.hierynomus.smbj);
importPackage(Packages.com.hierynomus.smbj.auth);
importPackage(Packages.com.hierynomus.smbj.share);
importPackage(Packages.com.hierynomus.msdtyp);
importPackage(Packages.com.hierynomus.mssmb2);
/**
* @param {string} server - server_fqdn
* @param {string} share - C$
* @param {string} path - tmp/test.csv
* @param {string} user - administrator
* @param {string} password - password
* @param {string} domain - domain
*
* This 3rdpart jars are needed:
*
* asn-one-0.5.0.jar
* bcprov-jdk15on-1.70.jar
* mbassador-1.3.2.jar
* smbj-0.12.2.jar
*/
function smbConnectReadFile(server, share, path, user, password, domain) {
try {
var smbClient = new SMBClient();
var session = smbClient.connect(server).authenticate(
new AuthenticationContext(user, password.toCharArray(), domain)
);
var share = session.connectShare(share);
var file = share.openFile(
path,
EnumSet.of(Packages.com.hierynomus.msdtyp.AccessMask.GENERIC_ALL),
null,
EnumSet.of(Packages.com.hierynomus.mssmb2.SMB2ShareAccess.FILE_SHARE_READ),
Packages.com.hierynomus.mssmb2.SMB2CreateDisposition.FILE_OPEN,
null
);
var reader = new java.io.BufferedReader(new java.io.InputStreamReader(file.getInputStream()));
var content = "";
var line
while ((line = reader.readLine()) !== null) {
content += line + "\n";
}
reader.close();
task.logmsg("DEBUG", "File content:\n" + content);
session.close();
smbClient.close();
} catch (e) {
var errorMessages = {
"STATUS_OBJECT_NAME_NOT_FOUND": "File not found: ",
"STATUS_LOGON_FAILURE": "Logon failure (invalid credentials): ",
"STATUS_ACCESS_DENIED": "Insuficient permissions of the application account: "
};
if (e instanceof Packages.com.hierynomus.mssmb2.SMBApiException) {
for (var key in errorMessages) {
if (e.getMessage().startsWith(key)) {
task.logmsg("ERROR", errorMessages[key] + e);
return;
}
}
}
task.logmsg("ERROR", "Unexpected error: " + e);
}
}
------------------------------
Jakub Nejdl
Original Message:
Sent: Wed February 26, 2025 06:25 AM
From: Franz Wolfhagen
Subject: ISVDI - cifs integration - best practice
Windows CIFS/SAMBA authentication is somewhat off topic for this forum I think - but if somebody knows something about it I will read it with interest.
I believe you probably will find better support on forums for the SAMBA Java integrations.
------------------------------
Franz Wolfhagen
WW IAM Solution Architect - Certified Consulting IT Specialist
IBM Expert Labs
Original Message:
Sent: Wed February 26, 2025 06:03 AM
From: Jakub Nejdl
Subject: ISVDI - cifs integration - best practice
Thank you Franz for your response. About NTLM. Well as far as I know, the newer versions of samba (SMB2) do not support NTLM - it support at most NTLMv2, which is banned in the companies for security reasons by GPO. Other options Ive found are for example kerberos or something called pre-auth integrity. But to be honest, authentication was one of the things I wanted to discuss and ask for advice :) .
------------------------------
Jakub Nejdl
Original Message:
Sent: Wed February 26, 2025 03:34 AM
From: Franz Wolfhagen
Subject: ISVDI - cifs integration - best practice
I have tried many things - but not this ;-)
Doing a brief look through the APIDOC I think the foremost challenge is that you will need to set (and later unset) Java system properties to define the parameters used for the connection. Setting is easy (just use the SDI system.setProperty() method (though in an adapter you may have to use the fully qualified name of the UserFunction class name as "System" is not always loaded in a Dispatcher) - unset of a Java Property you need to go to the native methods of Java - there is no helper method implemented for that in SDI.
I do not quite understand the "without ntlm authentication" - can you clarify that a little more - in my brief look through I only saw NTLM authentication methods in the samples - I have not deep dived...
As a standard recommendation to avoid class conflicts I would load the jars dynamically - either using the IDILoader or using the solution.properties of the dispatcher and a local directory under the dispatcher directory.
------------------------------
Franz Wolfhagen
WW IAM Solution Architect - Certified Consulting IT Specialist
IBM Expert Labs
Original Message:
Sent: Wed February 26, 2025 03:05 AM
From: Jakub Nejdl
Subject: ISVDI - cifs integration - best practice
does anyone have experience with integration to samba share within SMB2/SMB3 (without ntlm authentication) within ISVDI script? I am creating an ISVG-IM custom adapter to reconcile a data file from a samba share and I want the authentication to be part of the configuration (not at the user level under which the RMI dispatch service is running). From the service form I pass the file path to the samba share, user and password and I need to authenticate under this domain user to access the file. Any ideas?
I've found tutorials to use smbj and jcifs-ng libraries. Just wondering if anyone has experience with this and advice on how best to proceed.
Thank you
------------------------------
Jakub Nejdl
------------------------------