如何将旧版本NTLM认证代码迁移至Apache HttpClient 5

问题背景 #

原有基于Apache HttpClient 4.x的RestTemplate NTLM认证代码，迁移至最新org.apache.hc.client5时，CredentialsProvider及NTCredentials的API无法直接一对一转换，需调整适配新API规范。

迁移至Apache HttpClient 5的解决方案 #

以下是完整的迁移后代码，关键变更点已标注：

import org.apache.hc.client5.http.auth.AuthScope;
import org.apache.hc.client5.http.auth.AuthSchemes;
import org.apache.hc.client5.http.auth.NTCredentials;
import org.apache.hc.client5.http.config.RequestConfig;
import org.apache.hc.client5.http.impl.auth.BasicCredentialsProvider;
import org.apache.hc.client5.http.impl.classic.CloseableHttpClient;
import org.apache.hc.client5.http.impl.classic.HttpClients;
import org.springframework.http.client.HttpComponentsClientHttpRequestFactory;
import org.springframework.web.client.RestTemplate;

import java.util.Collections;

// 业务方法内代码
String url = "something";

// 1. 替换CredentialsProvider实现（包路径变更）
BasicCredentialsProvider credsProvider = new BasicCredentialsProvider();
// 2. NTCredentials包路径更新，参数含义与原代码一致
credsProvider.setCredentials(AuthScope.ANY, 
        new NTCredentials(user, pass, host, domain));

// 3. RequestConfig构建调整：原setTargetPreferredAuthSchemes替换为setPreferredAuthSchemes
RequestConfig requestConfig = RequestConfig.custom()
        .setPreferredAuthSchemes(Collections.singletonList(AuthSchemes.NTLM))
        .build();

// 4. 构建HttpClient5标准客户端类型CloseableHttpClient
CloseableHttpClient httpClient = HttpClients.custom()
        .setDefaultCredentialsProvider(credsProvider)
        .setDefaultRequestConfig(requestConfig)
        .build();

// 5. Spring请求工厂适配HttpClient5（需Spring 5.3+版本）
HttpComponentsClientHttpRequestFactory requestFactory = new HttpComponentsClientHttpRequestFactory(httpClient);
RestTemplate restTemplate = new RestTemplate(requestFactory);

return restTemplate.getForObject(url, String.class);

关键迁移说明

• 依赖替换：移除原org.apache.httpcomponents:httpclient依赖，引入org.apache.hc.client5:httpclient5（建议使用最新稳定版，如5.3）
• 类路径变更：所有认证相关类（AuthScope、NTCredentials等）迁移至org.apache.hc.client5.http.auth包，BasicCredentialsProvider移至org.apache.hc.client5.http.impl.auth
• API调整：RequestConfig的认证方案配置方法从setTargetPreferredAuthSchemes统一为setPreferredAuthSchemes
• Spring版本要求：必须使用Spring 5.3及以上版本，该版本开始原生支持Apache HttpClient 5的适配

基于标准Java HttpClient的替代方案（无Apache依赖） #

若不想依赖Apache HttpClient，可使用Java 11+内置的java.net.http.HttpClient实现NTLM认证：

import java.net.Authenticator;
import java.net.PasswordAuthentication;
import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

// 业务方法内代码
String url = "something";

// 配置NTLM认证的Authenticator
Authenticator.setDefault(new Authenticator() {
    @Override
    protected PasswordAuthentication getPasswordAuthentication() {
        if ("ntlm".equalsIgnoreCase(getRequestingScheme())) {
            // 用户名格式需为domain\username
            return new PasswordAuthentication(domain + "\\" + user, pass.toCharArray());
        }
        return super.getPasswordAuthentication();
    }
});

HttpClient httpClient = HttpClient.newBuilder()
        .authenticator(Authenticator.getDefault())
        .build();

HttpRequest request = HttpRequest.newBuilder()
        .uri(URI.create(url))
        .GET()
        .build();

HttpResponse<String> response = httpClient.send(request, HttpResponse.BodyHandlers.ofString());
return response.body();

注意事项

• 仅支持Java 11及以上版本
• 用户名需按domain\username格式传入，否则NTLM认证可能失败
• 复杂NTLM场景（如特定工作站绑定）的灵活性不如Apache HttpClient5

内容的提问来源于stack exchange，提问作者Spyridon Non Serviam