title: PHP NTLM session with cURL
body: <p>So a little trivia first..</p>
  
  <p>There is written in ASP.NET website, which uses NTLM protocol to authenticate users that want to log in. It's perfectly ok when they normally use it, they type in website URL, they provide their credentials, authenticate and maintain session in web browser.</p>
  
  <p>What I want to do, is create PHP website that will act as bot. It is my companys internal website and I am approved to do so. The problem I run into, is managing session. Users will be able to type in their credentials in my PHP website, and my PHP website will authenticate them to target site, using cURL. </p>
  
  <p>The code I got so far is:</p>
  
  <pre><code>    $cookie_file_path = dirname(__FILE__) . '/cookies.txt';
      $ch = curl_init();
  
      //==============================================================
       curl_setopt($ch, CURLOPT_USERPWD, $username. ':' . $password);
       curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
       curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
       curl_setopt($ch, CURLOPT_USERAGENT, $user_agent);
       curl_setopt($ch, CURLOPT_URL, $url);
       curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
       curl_setopt($ch, CURLOPT_HTTPAUTH, CURLAUTH_ANY);
       curl_setopt($ch, CURLOPT_COOKIEFILE, $cookie_file_path);
       curl_setopt($ch, CURLOPT_COOKIEJAR, $cookie_file_path);
       curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
       curl_setopt($ch, CURLINFO_HEADER_OUT, true);
       curl_setopt($ch, CURLOPT_FAILONERROR, 0);
       curl_setopt($ch, CURLOPT_MAXREDIRS, 100);
      //=============================================================
      $ret = curl_exec($ch);
  </code></pre>
  
  <p>Above code logs in to target website by cURL (which manages NTLM handshake, as it seems), and fetches websites content. It also stores Session ID that is sent back in cookie file. </p>
  
  <p>What I'm trying to do next, is comment the <code>CURLOPT_USERPWD</code> option, in hope that this script will use session ID stored in cookie file to authenticate previously logged in user in second execution of this script. It could get rid of user credentials and do not store it anywhere that way, becouse it is not safe to store it in manually created session, database, or anywhere else.</p>
  
  <p>I need this becouse bot will be using CRON to periodically check if website status has changed and perform some user actions as reaction to this. But to do this, user first must be authenticated, and his username and password must not be stored anywhere, so I have to use session information estabilished when he initially logged in.</p>
  
  <p>CURL seems to NOT DO THIS. When I execute script second time with commented <code>CURLOPT_USERPWD</code> option, it does not use stored cookie to keep beeing authenticated. Instead, it <strong>REWRITES</strong> cookie file with not relevant data send to me from service as response to <strong>NOT AUTHRORISED</strong> access request. </p>
  
  <p>My questions are: 
  Why cURL doesnt use stored session information to keep beeing authenticated?
  Is there any way to maintain this session with cURL and NTLM protocol based website?</p>
  
  <p>Thanks in advance.</p>