Hot answers tagged

24

First of all - and in case other users happen to visit this page - there are only certain authentication methods that allow you to do promptless SSO. These are NTLM and Kerberos. LDAP - on the other hand - will never give you promptless SSO. NTLM is actually NTLMv1 and NTLMv2. These are very different and NTLMv1 is deprecated because of serious security ...


16

With the versions of Samba found in current versions of common distributions you can certainly have a Linux machine act as an NT-style domain controller (this has been the case for some time). I believe that taking part in an AD based domain is being actively worked on but not yet ready for production use, though it isn't something I've looked at recently ...


13

This has been included in the stable release of Chrome 5.x as of May 2010. It works similar to Internet Explorer in that "Intranet" URLs (without dots in the address) will attempt single sign-on if requested by the server. To enable passthrough for other domains, you need to run Chrome with an extra command line parameter: chrome.exe --auth-server-...


11

It is now possible in mod_auth_kerb 5.4 to strip the realm from REMOTE_USER with the following config directive: KrbLocalUserMapping On Of course, no Debian/Ubuntu version seems to ship 5.4 yet (sigh).


11

LDAP cannot provide Single Sign On. There is a big difference between being able to use the same users and having Single Sign On, which means that you login into all systems at once, with a single login form. Otherwise, LDAP is perfectly feasible for using the same login information in all systems. OAuth is just a protocol for doing the Sign On and it can ...


9

Its not hard and it's perfectly practical. We have a few hundred dual boot desktop machines that use AD auth as well as a number of servers which use AD auth to enable windows clients to use their samba shares without explicit auth by the users. There was another article on SF about what you need to do. Basically you need to config kerberos, winbind, nss ...


9

There are a couple things you can do with Google Apps. You can setup a SAML server connected to your AD network and then setup Google to authentication your Google Apps access against the SAML server. We have used a php application called simpleSAMLphp because we already have servers setup to run PHP and we have developers with php skills. The drawback of ...


8

Google has led you down the right track. Ideally you want both LDAP for the central user management and Kerberos for it's added security and SSO. LDAP alone will get you centralized user management but users will still have to re-authenticate with each service they are connecting too. That's where Kerberos comes in which issues the client a ticket which ...


8

Short answer: No. However, like @Nathan-C described, you can stand up the required services using Azure Iaas (either DC+DirSync+ADFS or DC+Dircync w/pwd sync) in order to achieve single sign-on between your your Office365 apps and your on-prem apps. You would need to deploy a VPN link between Azure and your local network. Azure AD is NOT "regular" Active ...


8

What's the question? The first one is the user logon name. The second one is the pre-Windows 2000 user logon name. The third one is the User Principal Name. All three are valid and exist by default for every user account. All three can be used to log in to the domain. You don't have to assign them at all. Based on your edit, when you created the UPN did ...


7

Yes, it is quite possible to push out certificate trusts to users. This is done through Group Policy. You can find it under Users -> Windows Settings - > Security Settings -> Public Key Policies. From there you can manage which certificates and certificate-authorities are to be trusted. The same hive exists on the Computer side of the GPO as well. You'll ...


6

It's the whole point of the authn/authz separation in 2.2 that you can authenticate with one mechanism, and authorize with another. Authentication provides you with a setting of REMOTE_USER, which you then can use authz_ldap against. In addition, authn_ldap searches then for a user (converting the REMOTE_USER to a DN if found, using search criteria you have ...


6

Authenticating is absolutely simple using Likewise Open. http://www.likewise.com/products/likewise_open/index.php Nearly my entire Linux infrastructure has centralized authentication and user management thanks to Likewise Open. It's stunningly simple to install and implement. I cannot possibly say enough good about it. As a note, UIDs and GIDs are ...


6

My gut says you've got a very large security token, possibly because the user is a member of a large number of groups. The AD Kerberos implementation is going to provide Apache with a Privilege Attribute Certificate (PAC) by default. This structure can be large if the user is a member of a significant number of groups. You can use the tokensz.exe tool to see ...


5

You configure the NTLM whitelist by launching Chrome with this additional parameter: chrome.exe --auth-server-whitelist="*example.com,*foobar.com,*baz" Source: https://sites.google.com/a/chromium.org/dev/developers/design-documents/http-authentication


5

Regarding the first question: I've worked with another LDAP system that allowed 'login' against various user attributes. The solution was to do two connections. The first connection, probably anonymously bound, queries LDAP with the user-supplied information to locate the RDN of their user object. The second connection attempts a bind-with-password with the ...


5

Perhaps "Centralized Authentication".


4

Chrome now has passthrough Windows authentication that will work on any host without a domain. If you use domains on all intranet site you'll need to use the --auth-server-whitelist command line option.


4

Samba4 is going to be able to do that, but it's still in alpha. If you're adventurous you can play with the latest releases.


4

I've found the Spinlock guides excellent for this; I've used them to set up an SSO environment with ssh ticket forwarding for a development office of about 30 developers. There are a lot of different components to this and it's somewhat of a bear to manage - you'll want a good LDAP client like Apache's Directory Studio for user maintenance. If there's an ...


4

When I left my last job, they had to go through much the same process. I had managed to get access to pretty much every root-like password we had. There was a mini-project to map out everything I had access to, and I gave them lists of where I knew I had access. My whole last week I had steadily reducing rights as various passwords, ACLs, and group-...


4

We decided that the combination of adding "ClearPass" to CAS and modifying the Exchange setup was going to be too hard to maintain, so our final solution is something like the squirrelmail solution that we didn't like. That is, we send HTML like this to the user ($something generally means an already properly escaped variable) from a button they push in our ...


4

The Official OpenAM Website has a Downloads section. Quoting the page you linked to: If you have not already done so, download and unzip the openam_953.zip file The Client SDK and samples are then available in the zip-root/openam/samples/openam-client.zip (corrected for current version of software, 9.5.3 as opposed to 9.0)


4

I have attempted the exact same thing as you have, specifically attempting to manage Linux and Windows with the same toolset, and have found nothing but pain and frustration. The two are so very different in setup, outlook, and design assumptions that tools that work well on one (SSH, PowerShell) are ugly, fragile hacks on the other platform (yes, there ...


4

The KVNO is the version number of the keytab, each time you generate a new keytab or the password is changed the KVNO gets incremented. The number should match what is inside the Active Directory. This error indicates that the keytab contains an entry that the master considers to be out of date. You can see the KVNO in the directory by using adsiedit.msc. ...


4

These certificates are the trust anchors. They allow you to verify signatures and therefore establish trust in the messages that have been exchanged. (This is very similar to trusted CA certificates that are configured in your browser for authenticating certificates of HTTPS sites.) The SAML requests and responses should be signed (the responses at the very ...


4

When ADFS 2.0 is used as a service provider (i.e. RP STS) it consumes assertions at URLs like https://sts.contoso.com/adfs/ls/ . The assertion consumer service URL is specific to the service provider. If ADFS is the service provider then the metadata URLs publish the assertion consumer URLs as follows. <AssertionConsumerService Binding="urn:oasis:names:...


4

Your pam configuration for passwd usually /etc/pam.d/chpasswd is making a call to pam_krb5.so either directly or as part of an include statement. Kerberos (GSSAPI/SPNEGO) for HTTP SSO is handled outside of pam making the most expedient solution to remove it entirely from your pam config (hopefully using a similar method as to what put it in).


3

My answer is going to be "why would you want to?" You're probably far better off implementing a Windows DC; it won't cost you that much, and you'll be on a supported and more predictable environment. AD isn't difficult - there's a lot in it, but it's not difficult. So long as you don't do bizarre or wacky stuff with it, it's incredibly robust and has low ...


3

I installed Windows Services for Unix and added a user in AD called "Unix Authenticator", then made the following config file changes on the linux machines: /etc/ldap.conf: host ldap.<foo>.com base cn=Users,dc=<foo>,dc=com binddn cn=Unix Authenticator,cn=Users,dc=<foo>,dc=com bindpw <password> nss_base_passwd cn=Users,dc=<foo>,...



Only top voted, non community-wiki answers of a minimum length are eligible