Add NTLM authentication for PagerDuty proxies

[sauravnz]

Description

Adds optional NTLM authentication for HTTPS proxy connections made by the PagerDuty alerter.

PagerDuty endpoints are HTTPS, so proxy authentication occurs while the client establishes the HTTP CONNECT tunnel. HTTPProxyAuth only adds Basic proxy credentials and cannot complete the NTLM challenge-response exchange described in discussion #1762.

This change:

• adds pagerduty_proxy_login and pagerduty_proxy_pass;
• uses an NTLM-aware HTTPS adapter when both credentials are configured;
• validates that the proxy URL and both credentials are supplied together;
• preserves existing unauthenticated proxy behavior;
• preserves Basic proxy authentication through credentials embedded in pagerduty_proxy;
• computes the NT hash with PyCryptodome so the exchange works in the Python 3.14/OpenSSL 3 image, where OpenSSL's legacy MD4 digest is disabled;
• updates the rule schema, runtime dependencies, PagerDuty documentation, and upcoming changelog;
• adds unit coverage plus a deterministic end-to-end NTLM proxy simulation.

Example:

pagerduty_proxy: http://proxy.example.com:8080
pagerduty_proxy_login: 'DOMAIN\username'
pagerduty_proxy_pass: '<password>'

The password is not logged. The implementation passes an in-memory NT hash to the NTLM adapter because its underlying ntlm-auth library otherwise asks OpenSSL for disabled MD4 support.

Validation

• make test-docker
  • Python 3.14.6
  • 1131 passed, 4 skipped
  • project Flake8 phase passed
  • Sphinx documentation build passed with -W
  • total coverage: 79%
  • elastalert/alerters/pagerduty.py: 92%
• Targeted PagerDuty run: 45 passed
• Changed-file Flake8: passed
• git diff --check: passed
• Production Dockerfile build: passed
• Production image import/version check:
  • ElastAlert2 2.31.0
  • requests-ntlm2 6.6.0
  • pycryptodomex 3.23.0
  • PagerDuty alerter import passed
  • known NT hash test vector passed
• Production image pip check: No broken requirements found

The simulated proxy test uses real loopback sockets rather than HTTP mocks. It:

1. observes an NTLM Type 1 negotiate message on the HTTPS CONNECT request;
2. returns an NTLM Type 2 challenge;
3. observes the Type 3 authenticate message;
4. establishes a TLS tunnel using an ephemeral certificate;
5. receives the PagerDuty HTTPS POST; and
6. returns 202 Accepted.

No corporate proxy was available during development. The protocol and application flow were therefore validated against the deterministic local NTLM proxy above. A real enterprise-proxy smoke test can be added later if maintainers request it.

Checklist

• I have reviewed the contributing guidelines.
• I have included unit tests for my changes or additions.
• I have successfully run make test-docker with my changes.
• I have manually exercised all relevant modes using the deterministic local NTLM proxy integration test.
• I have updated the documentation.
• I have updated the changelog.

Questions or Comments

• A corporate proxy was not available on the development network. The included test exercises the full NTLM CONNECT exchange and tunneled HTTPS request over real sockets. I cannot post outputs from my corporate/work network

[jertel]

Thanks for the submission. I have a few comments.

[sauravnz]

Validation completed after addressing the review feedback:

• PagerDuty unit tests: 44 passed
• Deterministic NTLM proxy integration test: 1 passed
• Changed-file Flake8 checks: passed
• git diff --check: passed

The integration test exercises the NTLM CONNECT negotiation and the tunneled PagerDuty HTTPS request. The review changes did not alter existing PagerDuty behavior or the generated NTLM hash value.