How can I implement single sign-on (SSO) using Microsoft AD for an internal PHP app?

Go To StackoverFlow.com

28

I'm vaguely aware that on a computer joined to a domain IE can be asked to send some extra headers that I could use to automatically sign on to an application. I've got apache running on a windows server with mod_php. I'd like to be able to avoid the user having to log in if necessary. I've found some links talking about Kerberos and Apache modules.

http://www.onlamp.com/pub/a/onlamp/2003/09/11/kerberos.html?page=last https://metacpan.org/pod/Apache2::AuthenNTLM

Since I'm running on Windows it's proven to be non-trivial to get Perl or Apache modules installed. But doesn't PHP already have access to HTTP headers?

I found this but it doesn't do any authentication, it just shows that PHP can read the NTLM headers. http://siphon9.net/loune/2007/10/simple-lightweight-ntlm-in-php/

I'd like to be able to have my users just point to the application and have them automatically authenticated. Has anyone had any experience with this or gotten it to work at all?

UPDATE Since originally posting this question, we've changed setups to nginx and php-fcgi still running on windows. Apache2 and php-cgi on windows is probably one of the slowest setups you could configure on windows. It's looking like Apache might still be needed (it works with php-fcgi) but I would prefer a nginx solution.

I also still don't understand (and would love to be educated) why HTTP server plugins are necessary and we can't have a PHP, web server agnostic solution.

2009-06-16 20:21
by reconbot
Is this an internal behind-the-firewall application - Bob Aman 2009-09-20 00:45
Yes it is interna - reconbot 2009-10-12 03:39
Is there anything else I can add to improve this question - reconbot 2009-10-13 19:00


17

All you need is the mod_auth_sspi Apache module.

Sample configuration:

AuthType SSPI
SSPIAuth On
SSPIAuthoritative On
SSPIDomain mydomain

# Set this if you want to allow access with clients that do not support NTLM, or via proxy from outside. Don't forget to require SSL in this case!
SSPIOfferBasic On

# Set this if you have only one domain and don't want the MYDOMAIN\ prefix on each user name
SSPIOmitDomain On

# AD user names are case-insensitive, so use this for normalization if your application's user names are case-sensitive
SSPIUsernameCase Lower
AuthName "Some text to prompt for domain credentials"
Require valid-user

And don't forget that you can also use Firefox for transparent SSO in a Windows domain: Simply go to about:config, search for network.automatic-ntlm-auth.trusted-uris, and enter the host name or FQDN of your internal application (like myserver or myserver.corp.domain.com). You can have more than one entry, it's a comma-separated list.

2009-10-15 03:32
by realMarkusSchmidt
This works, you get the bounty and I get stuck with apache. Some of the others might work too, but still nothing that doesn't require apache or iis. I hope to revisit this problem one day - reconbot 2009-10-16 20:43


1

I had a similar problem which I needed to solve for my organization.

I was looking into using adLDAP.

There is some documentation on the site for achieving seamless authentication with Active Directory too.

2009-10-12 04:09
by asgeo1
The link in question for the documentation is http://adldap.sourceforge.net/wiki/doku.php?id=seamless_authentication I'll take a loo - reconbot 2009-10-12 13:25
There is some good info about redirecting to an iis server for authentication with a token, but it mainly pushes apache modules on linux - reconbot 2009-10-12 13:56


1

I'd be curious about a solution that uses OpenID as a backend (of sorts) for this... I wasn't seeing anything that would hook into ActiveDirectory directly when I googled (quickly). However, it could be pretty painless to implement over plain HTTP(S) (you'd be an OpenID provider that checked credentials against your local AD). In a best case scenario, you might be able to just add a couple classes to your app and be off and running -- no web server modules required. There is a lot of open source code out there for either side of this, so if nothing else, it's worth taking a look. If you exposed the backend to the users (i.e. gave them OpenID URLs), you'd have the added benefit of them being able to log in to more than just your internal sites using these credentials. (Example: Stack Overflow.)

As an aside, I'd be against making it so that Internet Explorer is required. I'm not sure if that is the goal from the way you wrote the question, but depending on your IT environment, I'd expect people who use Firefox or Safari (or Opera or ...) to be less than enthusiastic. (You're not developing against IE first, are you? That's been painful whenever I've done so.) This is not to say that you couldn't use this feature of IE, just that it shouldn't be the only option. The link you posted stated that NTLM worked with more than IE, but since I don't have any experience with it, it's hard to judge how well that would work.

2009-10-15 02:51
by Benjamin Oakes
All browsers support NTLM authentication. IE is no longer a requirement - Kevin Peno 2012-04-25 18:55


0

One option for you is to use CAS (central authentication service).

It has php client library.

How-to link to MS Active Directory: http://www.ja-sig.org/wiki/display/CASUM/Active+Directory

You would require Apache maven 2 though.

2009-10-15 02:14
by Hrishi


0

For IIS/PHP FCGI, You need to send out an unauthorized header:

function EnableAuthentication()
{
    $realm = "yoursite";
    header('WWW-Authenticate: Digest realm="'.$realm.'",qop="auth",nonce="'.uniqid().'",opaque="'.md5($realm).'"');
    header("HTTP/1.1 401 Unauthorized"); 
    exit;
}

You can then get at the username with:

$winuser = $_SERVER["REMOTE_USER"];

I then make sure the $winuser is in my database of allowed users.

Be SURE and test this under a non-privileged account. When I first installed this I tested it and it worked fine, but later when a standard non-server-admin user tried it this failed. Turns out some of the temporary directories need to have permissions changed for guest users. I can't recall the exact settings.

2009-10-16 19:05
by Will Shaver
Does this work for non iis servers - reconbot 2009-10-16 20:36
I don't manage any non-iis servers so I don't know - Will Shaver 2009-10-20 15:37
Ads