Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is there a way to integrate an LDAP authentication system on a windows network with intranet webapps so that the user on logging into their desktop does not need to log in a second time with the web app?

Open to other forms of authenticating other than LDAP if not possible.

share|improve this question
    
I'm not sure whether this should stay here or go to stackoverflow.com. Perhaps you can elaborate, is this a pre-packaged product you're using or are you developing/modifying it? –  ThatGraemeGuy May 15 '10 at 12:39
    
I'm not using any but I'd like to know if one exists. –  rutherford May 19 '10 at 6:32

4 Answers 4

Yes, it is doable. If it is apache, load mod_authz_ldap and point to your Active directory. Or point it to openldap proxy, which fetches auth credentials from active directory.

http://www.turnpike420.net/linux/Apache_ADS_AuthLDAP.txt

share|improve this answer
    
thanks for this - so how would I integrate this into my web application? –  rutherford May 19 '10 at 6:40
    
Your question is so broad: we don't know what webserver you are using, for instance. So, you need to do some prep work. –  RainDoctor May 27 '10 at 4:34

Basically, this is possible. If your particular webapp is capable of handling this depends on your environment and if this webapp is prepared for this.

Some questions: Do you use Active Directory for authentication? What is your webserver? IIS on Windows, Apache on Linux? Something else? What are the apps? What auth methods do they offer?

The most important thing you should research in this regard is Kerberos, which is used by Active Directory (and many other things) for exactly this purpose: Single sign on.

Regardless of the technology, prepare for a challenging experience, as doing this right is quite difficult.

share|improve this answer
    
doing it right is really easy, the Mediawiki LDAP auth extension is simple, and Redmine's built-in LDAP authentication is brilliant. You do have to understand LDAP however, which is where the challenge lies. –  gbjbaanb May 17 '10 at 19:01
    
No. Single sign on is not just the same user database, which is indeed easy, but not to have to login again if you are already logged in to your workstation. This is not easy. –  Sven May 17 '10 at 20:33
    
I am not restricted to any win/linux on the server but have a preference for an open source solution. The apps would be my bespoke webapps and normally would be authentication would be managed via db and session cookies. Does this make sense? I will look into Kerberos, is there any specific software that helps with the ticket fetching process from a web app perspective? –  rutherford May 19 '10 at 6:55

There are two technologies for that: Kerberos and NTLM. There are a lot of info on how to implement both, the best choice will depend on your IT environment.

share|improve this answer

You could consider a web single sign-on solution such as OneLogin.

http://www.onelogin.com

OneLogin integrates with Active Directory using NTLM so that if you are logged into your Windows domain, you're automatically also logged into OneLogin and any web app you have configured is just one click away.

OneLogin is pre-integrated with 600+ web applications, including intranet solutions like SocialText, Confluence, PBWorks and Jive, both behind and outside the firewall.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.