SOAP and NTLM: now available in red too!

Posted by Peter Vanbroekhoven on Jan 28, 2010

As more and more of our clients start using SharePoint, we have been investigating how to connect to a SharePoint server using Ruby. SharePoint has a full-fledged set of SOAP services that we can address from Ruby. The SOAP client library bundled with Ruby, called soap4r (also available separately), didn't work for us on SharePoint.

First off, SharePoint usually requires NTLM authentication and soap4r does not support it. Also, soap4r has problems with some of the WSDL's out there in the wild. The errors it raises when you try to load such WSDL's can be incomprehensible to someone not familiar with the details of WSDL. As soap4r is quite complex, we weren't particularly looking forward to patching it to support NTLM and the troubling WSDL's either.

The solution we have been using up to now was to have a small generic soap service running on the SharePoint server that does the authentication for us and forwards the requests to the SharePoint services. The problem with this wrapper was that it couldn't use the WSDL, that it was written in C# and none of us have enough experience with that, and that it needs an IIS server to run.

Recently a new Ruby SOAP library reared its heavy metal head: Savon. Whereas soap4r is time-tested, Matz-approved, but somewhat dated, Savon is fresh, lean, but inexperienced. The thing is, though: Savon doesn't bail out on us on the SharePoint WSDL's, plus the code is simple enough to understand and patch to add NTLM support.

Our patch for the NTLM support can be found in a fork at GitHub. It mirrors the basic_auth functionality, so it can be used as follows:

client = Savon::Client.new("http://host/sites/XAOP/_vti_bin/Lists.asmx?WSDL")
client.request.ntlm_auth(login, password)
puts client.get_list_collection

Note that we set the authentication before we call the web service. This is not only to avoid having to specify the authentication for all calls we'll be doing, but also to use it when fetching the WSDL itself. The latter is something that tends to be overlooked.

With this patch it looks like Savon gets us everything we need to talk to SharePoint. We'll need to head further down the road to know if it will give us a smooth or a bumpy ride, but it looks like a promising avenue at the moment.