JMeter中Windows身份验证重定向请求返回401 Unauthorized问题求助

我录制了一个Windows用户登录Web应用的流程，第一个请求返回302重定向，在JMeter中运行正常，但第二个重定向请求返回401 Unauthorized。已配置JMeter的Auth Manager（截图略）。

第一个请求（正常返回302） #

原始请求头 #

:authority: XXX.XXXXX.es
:method: GET
:path: /
:scheme: https
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
accept-encoding: gzip, deflate, br
accept-language: es-ES,es;q=0.9
cache-control: max-age=0
sec-ch-ua: "Google Chrome";v="105", "Not)A;Brand";v="8", "Chromium";v="105"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
sec-fetch-dest: document
sec-fetch-mode: navigate
sec-fetch-site: none
sec-fetch-user: ?1
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36

JMeter中发送的请求头（带NTLM认证） #

Connection: keep-alive
Upgrade-Insecure-Requests: 1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate, br
Accept-Language: es-ES,es;q=0.9
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: document
DNT: 1
sec-ch-ua: "Google Chrome";v="105", "Not)A;Brand";v="8", "Chromium";v="105"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36
sec-fetch-User: ?1
sec-fetch-Site: none
Host: XXXXX.XXXXXX.XXX
Authorization: NTLM TlRMTVNTUAADAAAAGAAYAEgAAADQANAAYAAAAAAAAAAwAQAACgAKADABAAAQABAAOgEAAAAAAABKAQAABYKJogUBKAoAAAAPpG+BcRbb9Mv8EX9lGMYYvY9TRE0ddvXwHNW4kGw9skxCk1+crDQRAwEBAAAAAAAA4LrJUKfN2AFw2B3BDux8LgAAAAACAAwARABNAEIATQAwADAAAQAQAFMAVgBEAEUAOQAyADMAMQAEABoAYgBhAG4AYwBhAG0AYQByAGMAaAAuAGUAcwADACwAUwBWAEQARQA5ADIAMwAxAC4AYgBhAG4AYwBhAG0AYQByAGMAaAAuAGUAcwAFABoAYgBhAG4AYwBhAG0AYQByAGMAaAAuAGUAcwAHAAgAeyODUKfN2AEAAAAAAAAAADEAMAA3ADcAMwBQAFYAMQAwADcAMAAxADAA

第一个请求响应 #

<head><title>Document Moved</title></head>
<body><h1>Object Moved</h1>This document may be found <a HREF="https://XXXXX.XXXX.XX/XXXXXXX/">here</a></body>

响应状态：302重定向

第二个重定向请求（返回401） #

JMeter中发送的请求头 #

Connection: keep-alive
Upgrade-Insecure-Requests: 1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate, br
Accept-Language: es-ES,es;q=0.9
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: document
DNT: 1
sec-ch-ua: "Google Chrome";v="105", "Not)A;Brand";v="8", "Chromium";v="105"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36
sec-fetch-User: ?1
sec-fetch-Site: none
Host: XXXXX.XXXXXXX.XX

响应头 #

HTTP/1.1 401 Unauthorized
Content-Type: text/html
Server: Microsoft-IIS/10.0
WWW-Authenticate: Negotiate
X-Powered-By: ASP.NET
Date: Wed, 21 Sep 2022 10:45:50 GMT
Content-Length: 1293

解决建议 #

• 补充重定向域名的认证配置：NTLM认证需针对每个域名单独配置，若重定向到新域名，需在Auth Manager中添加该域名的用户名、密码及域信息。
• 确保重定向携带认证：在HTTP请求默认值或具体请求中勾选「Follow Redirects」，同时启用「Use KeepAlive」，NTLM认证依赖持久连接维持会话状态。
• 支持Negotiate认证：响应头返回WWW-Authenticate: Negotiate，说明服务器同时支持Kerberos/Negotiate认证。可在Auth Manager中同时启用NTLM和Negotiate，或设置JMeter系统属性httpclient.authentication.preference=NTLM优先使用NTLM。
• 手动处理重定向：关闭自动重定向，手动添加第二个请求，通过正则表达式提取第一个请求的重定向URL，并将NTLM认证信息关联到该请求。
• 核对域名匹配：确认Auth Manager中的「Domain」字段与服务器要求一致，若服务器期望完整域名而非NetBIOS域名，需调整配置。
• 查看调试日志：开启JMeter调试日志（设置log_level.jmeter.protocol.http=DEBUG），检查认证过程中的错误信息，定位失败原因。

内容的提问来源于stack exchange，提问作者user123043