@mcp-abap-adt/connection 1.9.0 → 1.9.1

package/dist/auth/ntlm.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Detect whether a WWW-Authenticate header (or a Negotiate challenge token) indicates NTLM.
+ * NTLM is rejected: only Kerberos/SPNEGO Negotiate is acceptable.
+ *
+ * Two cases:
+ *  - the header offers the NTLM scheme directly: `WWW-Authenticate: NTLM`
+ *  - an NTLM token tunneled via Negotiate: `Negotiate <base64>` where the base64 decodes to
+ *    bytes starting with the NTLM signature "NTLMSSP\0" (base64 prefix "TlRMTVNTUAA").
+ */
+export declare function isNtlmChallenge(wwwAuthenticate: string | undefined): boolean;
+//# sourceMappingURL=ntlm.d.ts.map

package/dist/auth/ntlm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ntlm.d.ts","sourceRoot":"","sources":["../../src/auth/ntlm.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,eAAe,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAiB5E"}

package/dist/auth/ntlm.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isNtlmChallenge = isNtlmChallenge;
+/**
+ * Detect whether a WWW-Authenticate header (or a Negotiate challenge token) indicates NTLM.
+ * NTLM is rejected: only Kerberos/SPNEGO Negotiate is acceptable.
+ *
+ * Two cases:
+ *  - the header offers the NTLM scheme directly: `WWW-Authenticate: NTLM`
+ *  - an NTLM token tunneled via Negotiate: `Negotiate <base64>` where the base64 decodes to
+ *    bytes starting with the NTLM signature "NTLMSSP\0" (base64 prefix "TlRMTVNTUAA").
+ */
+function isNtlmChallenge(wwwAuthenticate) {
+    if (!wwwAuthenticate)
+        return false;
+    const value = wwwAuthenticate.trim();
+    if (!value)
+        return false;
+    // Split on commas to handle multiple offered schemes, e.g. "Negotiate, NTLM"
+    const parts = value.split(',').map((p) => p.trim());
+    for (const part of parts) {
+        const lower = part.toLowerCase();
+        // direct NTLM scheme offer (word-boundary, not e.g. "Negotiate")
+        if (/^ntlm\b/i.test(part))
+            return true;
+        // NTLM tunneled inside a Negotiate token
+        if (lower.startsWith('negotiate ')) {
+            const token = part.slice('negotiate '.length).trim();
+            if (token.startsWith('TlRMTVNTUAA'))
+                return true; // base64("NTLMSSP\0")
+        }
+    }
+    return false;
+}

package/dist/connection/KerberosAbapConnection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"KerberosAbapConnection.d.ts","sourceRoot":"","sources":["../../src/connection/KerberosAbapConnection.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAErE,uGAAuG;AACvG,qBAAa,sBAAuB,SAAQ,sBAAsB;IAChE,OAAO,CAAC,GAAG,CAAS;IACpB,OAAO,CAAC,YAAY,CAAM;gBAEd,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,IAAI,EAAE,SAAS,CAAC,EAAE,MAAM;IAQ1E,OAAO,CAAC,MAAM,CAAC,cAAc;IAa7B,mDAAmD;cACnC,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC;IAK5C;;;;OAIG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IA0B9B,SAAS,CAAC,wBAAwB,IAAI,MAAM;CAS7C"}
+{"version":3,"file":"KerberosAbapConnection.d.ts","sourceRoot":"","sources":["../../src/connection/KerberosAbapConnection.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAErE,uGAAuG;AACvG,qBAAa,sBAAuB,SAAQ,sBAAsB;IAChE,OAAO,CAAC,GAAG,CAAS;IACpB,OAAO,CAAC,YAAY,CAAM;gBAEd,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,IAAI,EAAE,SAAS,CAAC,EAAE,MAAM;IAQ1E,OAAO,CAAC,MAAM,CAAC,cAAc;IAa7B,mDAAmD;cACnC,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC;IAK5C;;;;OAIG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAiC9B,SAAS,CAAC,wBAAwB,IAAI,MAAM;CAS7C"}

package/dist/connection/KerberosAbapConnection.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.KerberosAbapConnection = void 0;
 const axios_1 = require("axios");
 const kerberosSpnego_js_1 = require("../auth/kerberosSpnego.js");
+const ntlm_js_1 = require("../auth/ntlm.js");
 const AbstractAbapConnection_js_1 = require("./AbstractAbapConnection.js");
 /** Kerberos / SPNEGO single-leg auth: send Negotiate token, reuse the resulting SAP session cookie. */
 class KerberosAbapConnection extends AbstractAbapConnection_js_1.AbstractAbapConnection {
@@ -43,12 +44,17 @@ class KerberosAbapConnection extends AbstractAbapConnection_js_1.AbstractAbapCon
             this.setCsrfToken(token);
         }
         catch (error) {
-            this.logger?.warn(`[WARN] KerberosAbapConnection - connect deferred: ${error instanceof Error ? error.message : String(error)}`);
-            if (error instanceof axios_1.AxiosError &&
-                error.response?.headers &&
-                this.getCookies()) {
-                this.logger?.debug('[DEBUG] KerberosAbapConnection - cookies captured from error response during connect');
+            if (error instanceof axios_1.AxiosError && error.response?.headers) {
+                const wwwAuth = error.response.headers['www-authenticate'];
+                if ((0, ntlm_js_1.isNtlmChallenge)(wwwAuth)) {
+                    throw new Error('KerberosAbapConnection: server offered NTLM authentication, which is rejected. ' +
+                        'Only Kerberos/SPNEGO is supported. Ensure the SAP system accepts Kerberos (SPNEGO) for your user.');
+                }
+                if (this.getCookies()) {
+                    this.logger?.debug('[DEBUG] KerberosAbapConnection - cookies captured from error response during connect');
+                }
             }
+            this.logger?.warn(`[WARN] KerberosAbapConnection - connect deferred: ${error instanceof Error ? error.message : String(error)}`);
         }
     }
     buildAuthorizationHeader() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcp-abap-adt/connection",
-  "version": "1.9.0",
+  "version": "1.9.1",
   "description": "ABAP connection layer for MCP ABAP ADT server",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",