Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I want to know if it's possible to configure Apache for authentication against ActiveDirectory for users to use SIngle Sign-on. I know Internet Explorer can use it and it's called Windows Authentication.

share|improve this question
add comment

2 Answers

up vote 0 down vote accepted

IE's "Windows Authentication" is NTLM -- at least older versions. (I think that current "Windows Authentication" does negotiate). You would need mod_ntlm or mod_auth_ntlm_winbind for NTLMv2. I think that later versions of IE and windows can also do GSSAPI via negotiate, which would work using mod_auth_kerb. GSSAPI has the advantage that it can be made to work will all the major browsers and platforms.

Short answer - it's possible.

share|improve this answer
add comment

You can use authnz to accomplish this very task.

http://httpd.apache.org/docs/2.2/mod/mod_authnz_ldap.html

You'll need to create an unprivileged account for Apache to connect to AD to perform the authentication. It's possible to do things like conditionally allowing people access based on group memberships. In addition, you should be able to add the URL to trusted sites and have IE pass creds transparently so that there is no user interaction required to log in.

share|improve this answer
    
Details? Examples? Why IE will send NTLM credentials? And how apache should ask for them? –  Dmytro Leonenko Apr 1 '11 at 10:52
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.