How does SSO using Active Directory works where user is transparently logged in. (intranet webapp)

Question

I'm told that it's possible to make a web application not require a login. The user logs in to Windows, which authenticates via an Active Directory (LDAP) Lookup. Then, they should be able to go to my webapp and never see a login prompt. These customers have been referring to this as Single Sign On (perhaps incorrectly and part of my confusion).

But, from what I read Single Sign from the Tomcat docs is:

The Single Sign On Vale is utilized when you wish to give users the ability to sign on to any one of the web applications associated with your virtual host, and then have their identity recognized by all other web applications on the same virtual host.

This is perfectly clear to me. User has to login once and can access every webapp on an instance of tomcat. But, what I need to do is somehow let them login without ever providing any credentials to my tomcat server.

So, in order for this to work I imagine:

• User makes request for some page
• Server sees no session token and then request the client for some credentials.
• The clients browser without any intervention from the user provides some credentials to the server.
• Then, using those credentials provided by the clients browser it does a lookup in an LDAP.

I've seen some examples which use client side certificates... particularly the DoD PKI system which makes some sense to me because in those cases you configure Tomcat to request client side certs, but just logging into windows I don't see how this would work and what information the browser would pass to the server etc. Is this what NTLM is used for?

Answer 1

In a Windows Active Directory environment, Single Sign On is used to mean visiting an internal web page carries your Windows login permissions and the web server can act on them. It is something NTLM is used for, but newer implementations use Kerberos instead.

If you open a Sharepoint Server website it knows who you are without needing a login username and password, but this works only for internal websites on the same network, I don't think it makes much sense for it to work on a public website. (I can't tell if you mean "virtual host" as in an Apache vhost or as in an outsourced hosted server).

Here is a Microsoft document describing how Kerberos authentication works to a web server running IIS / ASP.Net: http://msdn.microsoft.com/en-us/library/ff647076.aspx

It looks possible to do with Apache/Tomcat/Java. Here is a PDF describing a UK University implementation of that: http://gfivo.ncl.ac.uk/documents/UsingKerberosticketsfortrueSingleSignOn.pdf and a Codeplex project for it: http://tomcatspnego.codeplex.com/ and Openfire have some documentation to do with generally working with Java/Kerberos here (http://community.igniterealtime.org/docs/DOC-1060 ).

Answer 2

Is sounds like you are describing what Microsoft refers to as Integrated Windows Authentication.

It looks like Tomcat does support Windows Authentication, based on this article.

Answer 3

For starters, you cannot avoid login. If you want to identify users, you have to have them login. Forget NTLM, Kerberos comes to the rescue - it can do everything in a completely transparent manner.

The SingleSignOnValve is not what you are looking for. If you use Tomcat 7, you can use the SpnegoAuthenticator right away but on 6 you have to use this.