Support NTLM Auth Inside Lambda Functions

[ewindsor31]

Describe the feature

This request is the same as #735 which was closed due to staleness.

Add in the missing required libraries to make NTLM auth work in a .net core lambda.

Use Case

We are struggling to consume older soap-based services that rely on NTLM authentication. The workaround to create a custom image with the necessary dependencies and deploy that to our lambda increases build time and requires increased maintenance.

Proposed Solution

Install the gssntlmssp (sometimes called gss-ntlmssp) in the lambda runtime so it is available for use

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

AWS .NET SDK and/or Package version used

Not relevant

Targeted .NET Platform

.Net 6 and above

Operating System and version

AmazonLinux

[ashishdhingra]

Needs review with the team.

[ewindsor31]

Is there any update on this issue?

[ewindsor31]

@ashishdhingra Is there any update on this issue

[altso]

@ewindsor31 do you have an example of the workaround you mentioned in Use Case section? Is it just about installing gssntlmssp or is there anything else that needs to be done?

[altso]

I tried installing gssntlmssp in docker lambda - got "No package gssntlmssp available" error.

FROM public.ecr.aws/lambda/dotnet:7
RUN yum install -y epel-release gssntlmssp
...

#6 0.858 Loaded plugins: ovl
#6 8.541 No package epel-release available.
#6 8.722 No package gssntlmssp available.
#6 8.769 Error: Nothing to do

[ewindsor31]

you have to install epel-release from its source, the starting image doesn't have the package yet. Here is the dockerfile that I use as my runtime image.

FROM public.ecr.aws/lambda/dotnet:6

RUN yum makecache
RUN yum -y install http://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
RUN yum -y install gssntlmssp

[ewindsor31]

And here is the dockerfile for my lambdas. The RUNTIME_IMAGE argument is the image created by my comment above. You could combine these together, but I wanted to shorten my build pipeline and the url for epel-release would occasionally fail to download and cause the whole pipeline to fail.

ARG RUNTIME_IMAGE
FROM mcr.microsoft.com/dotnet/sdk:6.0 as build-image

ARG FUNCTION_DIR="/build"
ARG SAM_BUILD_MODE="run"
ENV PATH="/root/.dotnet/tools:${PATH}"

RUN apt-get update && apt-get -y install zip

RUN mkdir $FUNCTION_DIR
WORKDIR $FUNCTION_DIR
COPY <your projects contents> $FUNCTION_DIR/
RUN dotnet tool install -g Amazon.Lambda.Tools

# Build and Copy artifacts depending on build mode.
RUN mkdir -p build_artifacts
RUN dotnet lambda package --configuration Release;
RUN cp -r /build/bin/Release/net6.0/publish/* /build/build_artifacts; 

FROM ${RUNTIME_IMAGE}

COPY --from=build-image /build/build_artifacts/ /var/task/
# Command can be overwritten by providing a different command in the template directly.
CMD [ Your function handler ]