title: How does NTLM SSO in a Windows Domain works?
body: <p>I made a proof of concept for single-sign-on in TypeScript using <a href="https://github.com/abbr/NodeSSPI/" rel="nofollow noreferrer">NodeSSPI</a>. This works, I get the username where I'm logged in on our corporate AD domain - without entering any account information or credentials. But I want to know how this is possible in detail, cause it works in IE and Chrome out of the box. I found this <a href="https://msdn.microsoft.com/en-us/library/aa378749%28VS.85%29.aspx" rel="nofollow noreferrer">MSDN article about NTLM</a> which says:</p>
  
  <ol>
  <li>Username of the logged in user is send to the server</li>
  <li>Server generated random number challenge and send it to the client</li>
  <li>Client encrypts the challenge with the user password hash and send it back to server</li>
  <li>Server sends username, challenge and challenge-response to DC</li>
  <li>DC compares the PW with the database and authenticates the user if it matches</li>
  </ol>
  
  <p>I'm especially wonder about step 1 and 2: Where does this happen? How is e.g. the username transfered to the server? Is it part of the http request? I took a look in the request from the chrome developer tools and couldn't see any header or other information which indicates that e.g. my AD username is send to the server. </p>
  
  <p><strong>Please note:</strong> These questions only apply to SSO where <strong>no</strong> credentials are supplied by the user! Cause when the user enters his credentials this is clear. </p>