winrm-s 0.3.6 → 0.3.7.dev

data/README.md

@@ -1,69 +1,69 @@
-winrm-s
-=======
-
-`winrm-s` extends the functionality of the
-[WinRM gem](http://rubygems.org/gems/winrm) to support the Microsoft
-[Negotiate protocol](http://msdn.microsoft.com/en-us/library/windows/desktop/aa378748(v=vs.85).aspx)
-when authenticating to a remote [WinRM](http://msdn.microsoft.com/en-us/library/aa384426(v=vs.85).aspx) endpoint from a Windows system.
-
-This extended functionality is **only** supported when running on Microsoft
-Windows. This gem can still be used on other operating systems just like the
-`WinRM` gem, but the extended capabilities will not be available.
-
-Installation
-------------
-
-To install it, run:
-
-    gem install winrm-s
-
-Usage
------
-
-`winrm-s` provides the same interface as the `winrm` gem -- see `winrm`
-[documentation](https://github.com/WinRb/WinRM/blob/master/README.md) for `winrm-s` usage.
-
-* To use it, simply require `winrm` or `winrm-s`, depending on whether your code
-is running on Windows. The extended negotiate protocol is only available if
-you include `winrm-s`, which will only work on Windows.
-* When you use WinRM::WinRMWebService.new, be sure to specify the
-  `:sspinegotiate` parameter, along with a user name in the form `domain_name\user_name`
-  for the user name in order to make use of negotiate protocol. If the user
-  account is local to the remote system, you can use `.` for the domain. The
-  example further on demonstrates the negotiate use case.
-* All other use cases enabled by the `winrm` gem are also supported.
-
-Example
--------
-Note the argument value of `:sspinegotiate` for transport option, and the
-explicit specification of a domain name, in this case `.`, in the user name:
-```ruby
-if RUBY_PLATFORM =~ /mswin|mingw32|windows/
-  require 'winrm-s' # only works on Windows, otherwise use require 'winrm'
-  endpoint = http://mywinrmhost:5985/wsman
-  winrm = WinRM::WinRMWebService.new(endpoint, :sspinegotiate, :user => ".\administrator", :pass => "adminpasswd")
-  winrm.cmd('ipconfig /all') do |stdout, stderr|
-    STDOUT.print stdout
-    STDERR.print stderr
-  end
-end
-```
-
-License
--------
-
-Copyright:: Copyright (c) 2014 Chef Software, Inc.
-License:: Apache License, Version 2.0
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-
+winrm-s
+=======
+
+`winrm-s` extends the functionality of the
+[WinRM gem](http://rubygems.org/gems/winrm) to support the Microsoft
+[Negotiate protocol](http://msdn.microsoft.com/en-us/library/windows/desktop/aa378748(v=vs.85).aspx)
+when authenticating to a remote [WinRM](http://msdn.microsoft.com/en-us/library/aa384426(v=vs.85).aspx) endpoint from a Windows system.
+
+This extended functionality is **only** supported when running on Microsoft
+Windows. This gem can still be used on other operating systems just like the
+`WinRM` gem, but the extended capabilities will not be available.
+
+Installation
+------------
+
+To install it, run:
+
+    gem install winrm-s
+
+Usage
+-----
+
+`winrm-s` provides the same interface as the `winrm` gem -- see `winrm`
+[documentation](https://github.com/WinRb/WinRM/blob/master/README.md) for `winrm-s` usage.
+
+* To use it, simply require `winrm` or `winrm-s`, depending on whether your code
+is running on Windows. The extended negotiate protocol is only available if
+you include `winrm-s`, which will only work on Windows.
+* When you use WinRM::WinRMWebService.new, be sure to specify the
+  `:sspinegotiate` parameter, along with a user name in the form `domain_name\user_name`
+  for the user name in order to make use of negotiate protocol. If the user
+  account is local to the remote system, you can use `.` for the domain. The
+  example further on demonstrates the negotiate use case.
+* All other use cases enabled by the `winrm` gem are also supported.
+
+Example
+-------
+Note the argument value of `:sspinegotiate` for transport option, and the
+explicit specification of a domain name, in this case `.`, in the user name:
+```ruby
+if RUBY_PLATFORM =~ /mswin|mingw32|windows/
+  require 'winrm-s' # only works on Windows, otherwise use require 'winrm'
+  endpoint = http://mywinrmhost:5985/wsman
+  winrm = WinRM::WinRMWebService.new(endpoint, :sspinegotiate, :user => ".\administrator", :pass => "adminpasswd")
+  winrm.cmd('ipconfig /all') do |stdout, stderr|
+    STDOUT.print stdout
+    STDERR.print stderr
+  end
+end
+```
+
+License
+-------
+
+Copyright:: Copyright (c) 2014 Chef Software, Inc.
+License:: Apache License, Version 2.0
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+

data/Rakefile

@@ -1,16 +1,16 @@
-require 'bundler'
-require 'rspec/core/rake_task'
-
-Bundler::GemHelper.install_tasks
-
-task :default => [:unit_spec]
-
-desc "Run all functional specs in spec directory"
-RSpec::Core::RakeTask.new(:functional_spec) do |t|
-t.pattern = 'spec/functional/**/*_spec.rb'
-end
-
-desc "Run all unit specs in spec directory"
-RSpec::Core::RakeTask.new(:unit_spec) do |t|
-t.pattern = 'spec/unit/**/*_spec.rb'
-end
+require 'bundler'
+require 'rspec/core/rake_task'
+
+Bundler::GemHelper.install_tasks
+
+task :default => [:unit_spec]
+
+desc "Run all functional specs in spec directory"
+RSpec::Core::RakeTask.new(:functional_spec) do |t|
+t.pattern = 'spec/functional/**/*_spec.rb'
+end
+
+desc "Run all unit specs in spec directory"
+RSpec::Core::RakeTask.new(:unit_spec) do |t|
+t.pattern = 'spec/unit/**/*_spec.rb'
+end

data/lib/winrm-s.rb

@@ -1,30 +1,30 @@
-#
-# Author:: Kaustubh Deorukhkar (<kaustubh@clogeny.com>)>
-# Copyright:: Copyright (c) 2014 Chef Software, Inc.
-# License:: Apache License, Version 2.0
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-
-require 'winrm'
-
-def windows?
-  !!(RUBY_PLATFORM =~ /mswin|mingw|windows/)
-end
-
-# Patch only on windows
-if windows?
-  require 'winrm/winrm_service_patch'
-else
-  raise "ERROR: winrm-s extensions to the winrm gem for the negotiate protocol are only supported on Windows. Require 'winrm' and not 'winrm-s' on non-Windows platforms."
-end
+#
+# Author:: Kaustubh Deorukhkar (<kaustubh@clogeny.com>)>
+# Copyright:: Copyright (c) 2014 Chef Software, Inc.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require 'winrm'
+
+def windows?
+  !!(RUBY_PLATFORM =~ /mswin|mingw|windows/)
+end
+
+# Patch only on windows
+if windows?
+  require 'winrm/winrm_service_patch'
+else
+  raise "ERROR: winrm-s extensions to the winrm gem for the negotiate protocol are only supported on Windows. Require 'winrm' and not 'winrm-s' on non-Windows platforms."
+end

data/lib/winrm-s/version.rb

@@ -1,22 +1,22 @@
-#
-# Author:: Kaustubh Deorukhkar (<kaustubh@clogeny.com>)
-# Copyright:: Copyright (c) 2014 Chef Software, Inc.
-# License:: Apache License, Version 2.0
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-
-module WinrmS
-  VERSION = "0.3.6"
-  MAJOR, MINOR, TINY = VERSION.split('.')
-end
+#
+# Author:: Kaustubh Deorukhkar (<kaustubh@clogeny.com>)
+# Copyright:: Copyright (c) 2014 Chef Software, Inc.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+module WinrmS
+  VERSION = "0.3.7.dev"
+  MAJOR, MINOR, TINY = VERSION.split('.')
+end

data/lib/winrm/helpers/assert_patch.rb

@@ -1,25 +1,25 @@
-
-module PatchAssertions
-
-  def self.assert_major_version(library_name, expected_major, override_var_name)
-    supported_major_ver = ENV[override_var_name] || expected_major
-    loaded_ver = Gem.loaded_specs[library_name].version
-    loaded_major_ver = loaded_ver.to_s.match(/(^\d+\.\d+)\.(.*)$/)[1]
-
-    version_match = false
-    Array(supported_major_ver).each do |version|
-      if loaded_major_ver.to_s == version.to_s
-        version_match = true
-      end
-    end
-    unless version_match
-      puts "WARNING: Unsupported version of #{library_name}. The supported major version of library is #{library_name} version #{expected_major}. This code path monkey patches few methods in #{library_name} to support additional features. This could possibly work, but it is advised to extensively test your version. If you are aware of the impact of using #{loaded_ver}, this warning can be disabled by setting #{override_var_name} to the major version #{loaded_major_ver}. "
-    end
-  end
-
-  def self.assert_arity_of_patched_method(klass, method_name, expected_arity)
-    if klass.instance_method(method_name).arity != expected_arity
-      puts "WARNING: Cannot patch method #{klass}::#{method_name} since your latest gem seems to have different method definition that cannot be safely patched. This could possibly work, but it is advised to extensively test your version. Please use the supported version of patched gem."
-    end
-  end
+
+module PatchAssertions
+
+  def self.assert_major_version(library_name, expected_major, override_var_name)
+    supported_major_ver = ENV[override_var_name] || expected_major
+    loaded_ver = Gem.loaded_specs[library_name].version
+    loaded_major_ver = loaded_ver.to_s.match(/(^\d+\.\d+)\.(.*)$/)[1]
+
+    version_match = false
+    Array(supported_major_ver).each do |version|
+      if loaded_major_ver.to_s == version.to_s
+        version_match = true
+      end
+    end
+    unless version_match
+      puts "WARNING: Unsupported version of #{library_name}. The supported major version of library is #{library_name} version #{expected_major}. This code path monkey patches few methods in #{library_name} to support additional features. This could possibly work, but it is advised to extensively test your version. If you are aware of the impact of using #{loaded_ver}, this warning can be disabled by setting #{override_var_name} to the major version #{loaded_major_ver}. "
+    end
+  end
+
+  def self.assert_arity_of_patched_method(klass, method_name, expected_arity)
+    if klass.instance_method(method_name).arity != expected_arity
+      puts "WARNING: Cannot patch method #{klass}::#{method_name} since your latest gem seems to have different method definition that cannot be safely patched. This could possibly work, but it is advised to extensively test your version. Please use the supported version of patched gem."
+    end
+  end
 end

data/lib/winrm/http/auth.rb

@@ -1,196 +1,196 @@
-#
-# Author:: Kaustubh Deorukhkar (<kaustubh@clogeny.com>)
-# Copyright:: Copyright (c) 2014 Chef Software, Inc.
-# License:: Apache License, Version 2.0
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-
-require 'httpclient/auth'
-
-require 'winrm/helpers/assert_patch'
-
-def validate_patch
-  # The code below patches the httpclient library to add support
-  # for encrypt/decrypt as described below.
-  # Add few restriction to make sure the patched methods are still
-  # available, but still give a way to consciously use later versions
-  PatchAssertions.assert_major_version("httpclient", [2.6,2.7], "USE_HTTPCLIENT_MAJOR")
-  PatchAssertions.assert_arity_of_patched_method(HTTPClient::WWWAuth, "filter_request", 1)
-  PatchAssertions.assert_arity_of_patched_method(HTTPClient::WWWAuth, "filter_response", 2)
-  PatchAssertions.assert_arity_of_patched_method(HTTPClient::SSPINegotiateAuth, "set", -1)
-  PatchAssertions.assert_arity_of_patched_method(HTTPClient::SSPINegotiateAuth, "get", 1)
-end
-
-# Perform the patch validations
-validate_patch
-
-# Overrides the HTTPClient::WWWAuth code to add support for encryption/decryption
-# of data sent during the NTLM auth over negotiate.
-
-# Also Overrides HTTPClient::SSPINegotiateAuth to remember user credentials, original
-# library code relies on the current login user credentials on the client machine. 
-
-# Below code helps ruby client to perform auth using the credentials provided to
-# ruby client, and also enhances to use encrypted channel.
-
-class HTTPClient
-
-  class WWWAuth
-
-    # Filter API implementation.  Traps HTTP request and insert
-    # 'Authorization' header if needed.
-    def filter_request(req)
-      @authenticator.each do |auth|
-        next unless auth.set? # hasn't be set, don't use it
-        if cred = auth.get(req)
-          auth.encrypt_payload(req) if auth.respond_to?(:encrypt_payload)
-          req.header.set('Authorization', auth.scheme + " " + cred)
-          return
-        end
-      end
-    end
-
-    # Filter API implementation.  Traps HTTP response and parses
-    # 'WWW-Authenticate' header.
-    #
-    # This remembers the challenges for all authentication methods
-    # available to the client. On the subsequent retry of the request,
-    # filter_request will select the strongest method.
-    def filter_response(req, res)
-      command = nil
-      if res.status == HTTP::Status::UNAUTHORIZED
-        if challenge = parse_authentication_header(res, 'www-authenticate')
-          uri = req.header.request_uri
-          challenge.each do |scheme, param_str|
-            @authenticator.each do |auth|
-              next unless auth.set? # hasn't be set, don't use it
-              if scheme.downcase == auth.scheme.downcase
-                challengeable = auth.challenge(uri, param_str)
-                command = :retry if challengeable
-              end
-            end
-          end
-          # ignore unknown authentication scheme
-        end
-      else
-        decrypted_content = res.content
-        @authenticator.each do |auth|
-          next unless auth.set? # hasn't be set, don't use it
-          decrypted_content = auth.decrypt_payload(res.content) if auth.respond_to?(:encrypted_channel?) && auth.encrypted_channel? && encrypted_content?(res.content)
-        end
-        # update with decrypted content
-        res.content.replace(decrypted_content) if res.content and !res.content.empty?
-      end
-      command
-    end
-
-    private
-    def encrypted_content? content
-      content.start_with?('--Encrypted ')
-    end
-  end
-
-  class SSPINegotiateAuth
-
-    begin
-      require 'win32/sspi'
-      SSPIEnabled = true
-    rescue LoadError
-      SSPIEnabled = false
-    end
-
-    begin
-      require 'gssapi'
-      GSSAPIEnabled = true
-    rescue LoadError
-      GSSAPIEnabled = false
-    end
-
-    # Override to remember creds
-    # Set authentication credential.
-    def set(uri, user, passwd)
-      # Check if user has domain specified in it.
-      if user
-        creds = user.split("\\")
-        creds.length.eql?(2) ? (@domain,@user = creds) : @user = creds[0]
-      end
-      @passwd = passwd
-    end
-
-    def set?
-      SSPIEnabled || GSSAPIEnabled
-    end
-
-    # Response handler: returns credential.
-    # See win32/sspi for negotiation state transition.
-    def get(req)
-      return nil unless SSPIEnabled || GSSAPIEnabled
-      target_uri = req.header.request_uri
-      domain_uri, param = @challenge.find { |uri, v|
-        Util.uri_part_of(target_uri, uri)
-      }
-
-      return nil unless param
-
-      state = param[:state]
-      authenticator = param[:authenticator]
-      authphrase = param[:authphrase]
-      case state
-      when :init
-        if SSPIEnabled
-          # Over-ride ruby win32 sspi to support encrypt/decrypt
-          require 'winrm/win32/sspi'
-          authenticator = param[:authenticator] = Win32::SSPI::NegotiateAuth.new(@user, @domain, @passwd)
-          @authenticator = authenticator #  **** Hacky remember as we need this for encrypt/decrypt
-          return authenticator.get_initial_token
-        else # use GSSAPI
-          authenticator = param[:authenticator] = GSSAPI::Simple.new(domain_uri.host, 'HTTP')
-          # Base64 encode the context token
-          return [authenticator.init_context].pack('m').gsub(/\n/,'')
-        end
-      when :response
-        @challenge.delete(domain_uri)
-        if SSPIEnabled
-          return authenticator.complete_authentication(authphrase)
-        else # use GSSAPI
-          return authenticator.init_context(authphrase.unpack('m').pop)
-        end
-      end
-      nil
-    end
-
-    def encrypted_channel?
-      @encrypted_channel
-    end
-
-    def encrypt_payload(req)
-      if SSPIEnabled
-        body = @authenticator.encrypt_payload(req.body)
-        req.http_body = HTTP::Message::Body.new
-        req.http_body.init_request(body)
-        req.http_header.body_size = body.length if body
-        # if body is encrypted update the header
-        if body.include? "HTTP-SPNEGO-session-encrypted"
-          @encrypted_channel = true
-          req.header.set('Content-Type', "multipart/encrypted;protocol=\"application/HTTP-SPNEGO-session-encrypted\";boundary=\"Encrypted Boundary\"")
-        end
-      end
-    end
-
-    def decrypt_payload(body)
-      body = @authenticator.decrypt_payload(body) if SSPIEnabled
-      body
-    end
-  end
-end
+#
+# Author:: Kaustubh Deorukhkar (<kaustubh@clogeny.com>)
+# Copyright:: Copyright (c) 2014 Chef Software, Inc.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require 'httpclient/auth'
+
+require 'winrm/helpers/assert_patch'
+
+def validate_patch
+  # The code below patches the httpclient library to add support
+  # for encrypt/decrypt as described below.
+  # Add few restriction to make sure the patched methods are still
+  # available, but still give a way to consciously use later versions
+  PatchAssertions.assert_major_version("httpclient", [2.6,2.7], "USE_HTTPCLIENT_MAJOR")
+  PatchAssertions.assert_arity_of_patched_method(HTTPClient::WWWAuth, "filter_request", 1)
+  PatchAssertions.assert_arity_of_patched_method(HTTPClient::WWWAuth, "filter_response", 2)
+  PatchAssertions.assert_arity_of_patched_method(HTTPClient::SSPINegotiateAuth, "set", -1)
+  PatchAssertions.assert_arity_of_patched_method(HTTPClient::SSPINegotiateAuth, "get", 1)
+end
+
+# Perform the patch validations
+validate_patch
+
+# Overrides the HTTPClient::WWWAuth code to add support for encryption/decryption
+# of data sent during the NTLM auth over negotiate.
+
+# Also Overrides HTTPClient::SSPINegotiateAuth to remember user credentials, original
+# library code relies on the current login user credentials on the client machine. 
+
+# Below code helps ruby client to perform auth using the credentials provided to
+# ruby client, and also enhances to use encrypted channel.
+
+class HTTPClient
+
+  class WWWAuth
+
+    # Filter API implementation.  Traps HTTP request and insert
+    # 'Authorization' header if needed.
+    def filter_request(req)
+      @authenticator.each do |auth|
+        next unless auth.set? # hasn't be set, don't use it
+        if cred = auth.get(req)
+          auth.encrypt_payload(req) if auth.respond_to?(:encrypt_payload)
+          req.header.set('Authorization', auth.scheme + " " + cred)
+          return
+        end
+      end
+    end
+
+    # Filter API implementation.  Traps HTTP response and parses
+    # 'WWW-Authenticate' header.
+    #
+    # This remembers the challenges for all authentication methods
+    # available to the client. On the subsequent retry of the request,
+    # filter_request will select the strongest method.
+    def filter_response(req, res)
+      command = nil
+      if res.status == HTTP::Status::UNAUTHORIZED
+        if challenge = parse_authentication_header(res, 'www-authenticate')
+          uri = req.header.request_uri
+          challenge.each do |scheme, param_str|
+            @authenticator.each do |auth|
+              next unless auth.set? # hasn't be set, don't use it
+              if scheme.downcase == auth.scheme.downcase
+                challengeable = auth.challenge(uri, param_str)
+                command = :retry if challengeable
+              end
+            end
+          end
+          # ignore unknown authentication scheme
+        end
+      else
+        decrypted_content = res.content
+        @authenticator.each do |auth|
+          next unless auth.set? # hasn't be set, don't use it
+          decrypted_content = auth.decrypt_payload(res.content) if auth.respond_to?(:encrypted_channel?) && auth.encrypted_channel? && encrypted_content?(res.content)
+        end
+        # update with decrypted content
+        res.content.replace(decrypted_content) if res.content and !res.content.empty?
+      end
+      command
+    end
+
+    private
+    def encrypted_content? content
+      content.start_with?('--Encrypted ')
+    end
+  end
+
+  class SSPINegotiateAuth
+
+    begin
+      require 'win32/sspi'
+      SSPIEnabled = true
+    rescue LoadError
+      SSPIEnabled = false
+    end
+
+    begin
+      require 'gssapi'
+      GSSAPIEnabled = true
+    rescue LoadError
+      GSSAPIEnabled = false
+    end
+
+    # Override to remember creds
+    # Set authentication credential.
+    def set(uri, user, passwd)
+      # Check if user has domain specified in it.
+      if user
+        creds = user.split("\\")
+        creds.length.eql?(2) ? (@domain,@user = creds) : @user = creds[0]
+      end
+      @passwd = passwd
+    end
+
+    def set?
+      SSPIEnabled || GSSAPIEnabled
+    end
+
+    # Response handler: returns credential.
+    # See win32/sspi for negotiation state transition.
+    def get(req)
+      return nil unless SSPIEnabled || GSSAPIEnabled
+      target_uri = req.header.request_uri
+      domain_uri, param = @challenge.find { |uri, v|
+        Util.uri_part_of(target_uri, uri)
+      }
+
+      return nil unless param
+
+      state = param[:state]
+      authenticator = param[:authenticator]
+      authphrase = param[:authphrase]
+      case state
+      when :init
+        if SSPIEnabled
+          # Over-ride ruby win32 sspi to support encrypt/decrypt
+          require 'winrm/win32/sspi'
+          authenticator = param[:authenticator] = Win32::SSPI::NegotiateAuth.new(@user, @domain, @passwd)
+          @authenticator = authenticator #  **** Hacky remember as we need this for encrypt/decrypt
+          return authenticator.get_initial_token
+        else # use GSSAPI
+          authenticator = param[:authenticator] = GSSAPI::Simple.new(domain_uri.host, 'HTTP')
+          # Base64 encode the context token
+          return [authenticator.init_context].pack('m').gsub(/\n/,'')
+        end
+      when :response
+        @challenge.delete(domain_uri)
+        if SSPIEnabled
+          return authenticator.complete_authentication(authphrase)
+        else # use GSSAPI
+          return authenticator.init_context(authphrase.unpack('m').pop)
+        end
+      end
+      nil
+    end
+
+    def encrypted_channel?
+      @encrypted_channel
+    end
+
+    def encrypt_payload(req)
+      if SSPIEnabled
+        body = @authenticator.encrypt_payload(req.body)
+        req.http_body = HTTP::Message::Body.new
+        req.http_body.init_request(body)
+        req.http_header.body_size = body.length if body
+        # if body is encrypted update the header
+        if body.include? "HTTP-SPNEGO-session-encrypted"
+          @encrypted_channel = true
+          req.header.set('Content-Type', "multipart/encrypted;protocol=\"application/HTTP-SPNEGO-session-encrypted\";boundary=\"Encrypted Boundary\"")
+        end
+      end
+    end
+
+    def decrypt_payload(body)
+      body = @authenticator.decrypt_payload(body) if SSPIEnabled
+      body
+    end
+  end
+end