Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

What is the best way to enable Integrated Windows Authentication for a PHP web application running on Apache2/Linux? There is a Windows Domain Controller in the network which should be used for authentication.

I found these apache modules:

But these modules seem to be very outdated (last updated 2007/2008). Is there a better, more up-to-date way to do this?

share|improve this question
    
Any specific or contemporary solution to this question? –  saji89 Nov 13 at 6:58
    
Sorry, no. I gave up on this one. –  Florian Fankhauser Nov 13 at 13:22
    
:( But, thanks for the quick reply. –  saji89 Nov 14 at 5:25

2 Answers 2

I believe WDC speaks LDAP, in which case you probably want mod_authnz_ldap instead.

share|improve this answer
    
Yes, but this requires using Basic Authentication which prompts for username/password. I want to use the login information of the windows session so that the user doesn't has to enter his credentials again (single-sign-on). –  Florian Fankhauser Jul 10 '12 at 12:00

The best option is mod_auth_sspi, it's reasonable up to date, most recently released in 2011.

I used mod_auth_sspi 1.0.4 with apache 2.2.9 on Windows Server 2003 and it works fine for Windows XP clients. They get logged in automatically. Here is my config, note that you don't need the SVN bit, but you can see how to restrict to specific groups.

# Set that only Domain Users can access this whole server
LoadModule sspi_auth_module modules/mod_auth_sspi.so
LoadModule dav_module         modules/mod_dav.so
LoadModule dav_svn_module     modules/mod_dav_svn.so
LoadModule authz_svn_module   modules/mod_authz_svn.so
LoadModule rewrite_module modules/mod_rewrite.so

<LocationMatch />
    AuthType SSPI
    AuthName "Windows Authentication"
    SSPIAuth On
    SSPIAuthoritative On
    SSPIDomain dmn.example.com
    SSPIOmitDomain On 
    SSPIOfferBasic Off 
    SSPIUsernameCase lower
</LocationMatch>

<LocationMatch /trac>
    Require valid-user
</LocationMatch>

# Share subversion repos under http://grp-svn:/svn/REPO_NAME
# We need developers to have read and write access and app support and prod support to have read only.
# The front office dev team also have access.
<Location /svn>
    DAV svn
    SVNParentPath D:\GRP-Data\svn\repos
    <Limit GET PROPFIND OPTIONS REPORT CHECKOUT>
        Require group "DMN\\GRP-DEV" "DMN\\GRP-SKY Production Support" "DMN\\FS_Sky_RO_DL" 
    </Limit>
    <Limit POST PUT DELETE PROPPATCH MKCOL COPY MOVE LOCK UNLOCK VERSION-CONTROL REPORT CHECKOUT CHECKIN UNCHECKOUT MKWORKSPACE UPDATE LABEL MERGE BASELINE-CONTROL MKACTIVITY ORDERPATCH ACL PATCH SEARCH>
        Require group "DMN\\GRP-DEV" "DMN\\AS_Apache FO_C_DL" 
    </Limit> 
</Location>
share|improve this answer
    
Thanks for your response. Unfortunately mod_auth_sspi only runs on Windows servers. What I need is a solution for Linux. –  Florian Fankhauser Jul 30 '12 at 11:57

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.