ntlm-auth

What it is and what it does

ntlm-auth is a low-level library that handles the cryptographic and message-parsing details of NTLM (NT LAN Manager) authentication, a Windows-based authentication protocol used by some enterprise HTTP services. It constructs the three-message NTLM handshake, encodes them as base64 for HTTP headers, and can optionally sign and seal message content for integrity and confidentiality. It supports multiple NTLM variants (LM, NTLMv1, NTLMv2) and extended session security, plus channel binding tokens for additional security.

The library is designed as a building block rather than a user-facing tool. The documentation explicitly recommends that most users install requests-ntlm instead, which provides a simpler interface for HTTP authentication. Direct use of ntlm-auth requires manual message exchange with a server and careful handling of the authentication state machine. The package depends only on ordereddict, keeping installation friction minimal.

Use it for:

• Authenticate HTTP requests to legacy Windows/Active Directory services that require NTLM when requests-ntlm is unavailable
• Implement custom NTLM authentication in a non-HTTP protocol or specialized client where a standard wrapper does not fit
• Sign and seal message content for integrity and confidentiality in NTLM-protected communication channels
• Integrate NTLM support into a proxy, gateway, or middleware that cannot use requests-ntlm directly

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Constructs and parses NTLM authentication messages (LM, NTLMv1, NTLMv2) for HTTP authentication, handling message signing and sealing with support for channel binding tokens.

No—not for new projects. The package is abandoned (last release June 2020, last commit July 2020) and most users should use requests-ntlm instead, which provides the same NTLM support with a simpler API. Install only if you have an existing codebase already using ntlm-auth and cannot migrate, or if you need direct low-level NTLM message construction for a non-HTTP use case and accept the maintenance risk.

Install

ntlm-auth on PyPI

pip install ntlm-auth

uv add ntlm-auth

poetry add ntlm-auth

Installing ntlm-auth

Before you install

Low install friction with a single pure-Python dependency (ordereddict). However, the package is abandoned—last commit was 2020-07-07 and no releases since 2020-06-16. Most users should prefer requests-ntlm, which wraps this library with a higher-level interface.

License in practice

MIT license (permissive) places no restrictions on use, modification, or distribution in proprietary or open-source projects.

Quickstart

from ntlm_auth.ntlm import NtlmContext

ntlm_context = NtlmContext('username', 'password', 'domain', ntlm_compatibility=3)
negotiate_message = ntlm_context.step()
# Send negotiate_message in HTTP header, receive challenge
authenticate_message = ntlm_context.step(challenge_response)

Requires Python 2.6+ or 3.4+; ordereddict dependency for older Python versions. Direct use is low-level; requests-ntlm is the recommended wrapper for HTTP clients.

Verify before relying

• Whether the package works reliably with modern Windows Server authentication in production environments post-2020
• Current compatibility with Python 3.8+ given the last release predates those versions
• Whether signing/sealing with RC4 meets current security requirements for your use case

Package facts

Evidence: ntlm_auth-1.5.0-py2.py3-none-any.whl

Keywords: authentication, auth, microsoft, ntlm, lm

Tags

More Security packages