(SQL Server) HTTP Authentication (Basic, NTLM, Digest, Negotiate)

Demonstrates how to use HTTP authentication. Authentication can be added to any method that sends an HTTP request to the server, such as SynchronousRequest, QuickGetStr, PostXml, etc. To add authentication, simply set the Login and Password properties.

By default, Chilkat will use basic HTTP authentication, which sends the login/password clear-text over the connection. This is bad if SSL/TLS (i.e. HTTPS) is not used. However, if the connection is secure, there should be nothing wrong with using basic authentication.

Chilkat supports more secure authentication types as well, including Digest, NTLM, and Negotiate. To use Digest authentication, simply set the DigestAuth property = 1. To use NTLM authentication, set the NtlmAuth property = 1. Likewise, to use Negotiate authentication, set the NegotiateAuth property = 1.

Important: Negotiate authentication is only supported for the Chilkat implementations that run on the Windows platform. This is because it is implemented internally using Microsoft's SSPI API. NTLM authentication however, is available for all supported operating systems because Chilkat implements NTLM directlly (i.e. does not use Microsoft SSPI for the underlying implementation.)

Chilkat ActiveX Downloads ActiveX for 32-bit and 64-bit Windows

// Important: See this note about string length limitations for strings returned by sp_OAMethod calls.
//
CREATE PROCEDURE ChilkatSample
AS
BEGIN
    DECLARE @hr int
    DECLARE @iTmp0 int
    DECLARE @sTmp0 nvarchar(4000)
    -- This example assumes the Chilkat API to have been previously unlocked.
    -- See Global Unlock Sample for sample code.

    DECLARE @http int
    EXEC @hr = sp_OACreate 'Chilkat_9_5_0.Http', @http OUT
    IF @hr <> 0
    BEGIN
        PRINT 'Failed to create ActiveX component'
        RETURN
    END

    -- Set the Login and Password properties for authentication.
    EXEC sp_OASetProperty @http, 'Login', 'chilkat'
    EXEC sp_OASetProperty @http, 'Password', 'myPassword'

    -- To use HTTP Basic authentication..
    EXEC sp_OASetProperty @http, 'BasicAuth', 1

    DECLARE @html nvarchar(4000)
    EXEC sp_OAMethod @http, 'QuickGetStr', @html OUT, 'http://localhost/xyz.html'
    EXEC sp_OAGetProperty @http, 'LastMethodSuccess', @iTmp0 OUT
    IF @iTmp0 <> 1
      BEGIN
        EXEC sp_OAGetProperty @http, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @http
        RETURN
      END

    -- Examine the HTTP status code returned.  
    -- A status code of 401 is typically returned for "access denied"
    -- if no login/password is provided, or if the credentials (login/password)
    -- are incorrect.

    EXEC sp_OAGetProperty @http, 'LastStatus', @iTmp0 OUT
    PRINT 'HTTP status code for Basic authentication: ' + @iTmp0

    -- Examine the HTML returned for the URL:

    PRINT @html

    DECLARE @http2 int
    EXEC @hr = sp_OACreate 'Chilkat_9_5_0.Http', @http2 OUT

    -- To use NTLM authentication, set the 
    -- NtlmAuth property = 1
    EXEC sp_OASetProperty @http2, 'NtlmAuth', 1

    -- The session log can be captured to a file by
    -- setting the SessionLogFilename property:
    EXEC sp_OASetProperty @http2, 'SessionLogFilename', 'ntlmAuthLog.txt'

    -- Examination of the HTTP session log will show the NTLM
    -- back-and-forth exchange between the client and server.

    -- This call will now use NTLM authentication (assuming it
    -- is supported by the web server).
    EXEC sp_OAMethod @http2, 'QuickGetStr', @html OUT, 'http://localhost/xyz.html'
    -- Note: 
    EXEC sp_OAGetProperty @http2, 'LastMethodSuccess', @iTmp0 OUT
    IF @iTmp0 <> 1
      BEGIN
        EXEC sp_OAGetProperty @http2, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @http
        EXEC @hr = sp_OADestroy @http2
        RETURN
      END


    EXEC sp_OAGetProperty @http2, 'LastStatus', @iTmp0 OUT
    PRINT 'HTTP status code for NTLM authentication: ' + @iTmp0

    DECLARE @http3 int
    EXEC @hr = sp_OACreate 'Chilkat_9_5_0.Http', @http3 OUT

    -- To use Digest Authentication, set the DigestAuth property = 1
    -- Also, no more than one of the authentication type properties 
    -- (NtlmAuth, DigestAuth, and NegotiateAuth)  should be set
    -- to 1.  
    EXEC sp_OASetProperty @http3, 'DigestAuth', 1

    EXEC sp_OASetProperty @http3, 'SessionLogFilename', 'digestAuthLog.txt'

    -- This call will now use Digest authentication (assuming it
    -- is supported by the web server).
    EXEC sp_OAMethod @http3, 'QuickGetStr', @html OUT, 'http://localhost/xyz.html'
    EXEC sp_OAGetProperty @http3, 'LastMethodSuccess', @iTmp0 OUT
    IF @iTmp0 <> 1
      BEGIN
        EXEC sp_OAGetProperty @http3, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @http
        EXEC @hr = sp_OADestroy @http2
        EXEC @hr = sp_OADestroy @http3
        RETURN
      END


    EXEC sp_OAGetProperty @http3, 'LastStatus', @iTmp0 OUT
    PRINT 'HTTP status code for Digest authentication: ' + @iTmp0

    EXEC @hr = sp_OADestroy @http
    EXEC @hr = sp_OADestroy @http2
    EXEC @hr = sp_OADestroy @http3


END
GO