You are here

README.txt in LDAP Single Sign On 7.2

Same filename and directory in other branches
  1. 6 README.txt
  2. 7 README.txt
=======================================
LDAP Single Sign-On
=======================================


To use the single sign-on feature, your web server must provide an authentication
mechanism for LDAP. The only authentication mechanism used in development
was mod_auth_sspi for Apache/Windows, but so long as the web server's LDAP
authentication mechanism is configured to provide the $_SERVER variable
$_SERVER['REMOTE_USER'] or $_SERVER['REDIRECT_REMOTE_USER'] corresponding
directly to a user's LDAP user name, this should work all the same. This
will require some sort of LDAP authentication mechanism; mod_auth_sspi is
available here: http://mod-auth-sspi.sourceforge.net/, while mod_ntlm is
available here: http://modntlm.sourceforge.net/, and mod_auth_ntlm_winbind is
available here: http://samba.org/ftp/unpacked/lorikeet/mod_auth_ntlm_winbind/.
If a Linux distribution is being used, Apache authentication modules are likely
available within the distro's package manager.

Unless an administrator wishes to require that all visitors be authenticated,
NTLM and/or basic authentication should be set up only on the path
user/login/sso, which will authentify the visitor but not deny access to view
the site if the visitor is not authenticated. An administrator may wish to
require LDAP authentication to view any portion of the site; this can be
achieved by changing the location directive below to "/". An administrator may
also wish to automatically log in visitors to Drupal; this can be achieved by
checking "Turn on automated single sign-on" in the modules' configuration page.

An example of an Apache configuration for a named virtualhost configuration
using mod_auth_sspi on Windows is as follows:


httpd.conf:
_______________________________________________________________________________
_______________________________________________________________________________




# Virtual hosts
Include conf/extra/httpd-vhosts.conf

# Pass NTLM authentication to Apache
LoadModule sspi_auth_module modules/mod_auth_sspi.so

<IfModule !mod_auth_sspi.c>
  LoadModule sspi_auth_module modules/mod_auth_sspi.so
</IfModule>



_______________________________________________________________________________
_______________________________________________________________________________




httpd-vhosts.conf:
_______________________________________________________________________________
_______________________________________________________________________________




NameVirtualHost example.com

<VirtualHost example.com>
  DocumentRoot "D:/www/example.com/htdocs"
  ServerName example.com

  <directory "D:/www/example.com/htdocs">
    Options Indexes FollowSymLinks MultiViews
    AllowOverride All
    Order Allow,Deny
    Allow from all
  </directory>

  <Location /user/login/sso>
    AuthType SSPI
    AuthName "Example.com - Login using your LDAP user name and password"
    SSPIAuth On
    SSPIAuthoritative On
    ### The domain used to authenticate with LDAP; this should match the domain
    ### configured in the LDAP integration configuration within Drupal
    SSPIDomain ad.example.com
    SSPIOmitDomain On
    SSPIOfferBasic On
    Require valid-user
    #SSPIBasicPreferred On
    #SSPIofferSSPI off
  </Location>
</VirtualHost>

_______________________________________________________________________________
_______________________________________________________________________________


After enabling and configuring an LDAP authentication module within Apache,
visit user/login/sso in the Drupal installation on example.com. With or without
the ldap sso feature enabled, the browser should prompt for a user name and
password if using Internet Explorer 8 or a non-Microsoft browser. Internet
Explorer 7 by default will pass NTLM authentication credentials to local
websites, and IE8 and Firefox can be configured to do this as well.

If prompted for credentials on that path, enter a valid LDAP user name,
omitting the domain if "SSPIOmitDomain On" is configured, as well as a password.
If the credentials are correct, or if NTLM credentials are passed automatically
by the browser and successfully authenticated, a Drupal 404 "Page not found"
message will be displayed if the module is not enabled; an "access is denied"
message will be displayed if the module is enabled and the browser is already
logged in; and if the ldap_sso module is fully configured and there is no
existing session, the browser will display the message "You have been
successfully authenticated" after redirecting to the sites' home page if you
have checked "Notify user of successful authentication".

File

README.txt
View source
  1. =======================================
  2. LDAP Single Sign-On
  3. =======================================
  4. To use the single sign-on feature, your web server must provide an authentication
  5. mechanism for LDAP. The only authentication mechanism used in development
  6. was mod_auth_sspi for Apache/Windows, but so long as the web server's LDAP
  7. authentication mechanism is configured to provide the $_SERVER variable
  8. $_SERVER['REMOTE_USER'] or $_SERVER['REDIRECT_REMOTE_USER'] corresponding
  9. directly to a user's LDAP user name, this should work all the same. This
  10. will require some sort of LDAP authentication mechanism; mod_auth_sspi is
  11. available here: http://mod-auth-sspi.sourceforge.net/, while mod_ntlm is
  12. available here: http://modntlm.sourceforge.net/, and mod_auth_ntlm_winbind is
  13. available here: http://samba.org/ftp/unpacked/lorikeet/mod_auth_ntlm_winbind/.
  14. If a Linux distribution is being used, Apache authentication modules are likely
  15. available within the distro's package manager.
  16. Unless an administrator wishes to require that all visitors be authenticated,
  17. NTLM and/or basic authentication should be set up only on the path
  18. user/login/sso, which will authentify the visitor but not deny access to view
  19. the site if the visitor is not authenticated. An administrator may wish to
  20. require LDAP authentication to view any portion of the site; this can be
  21. achieved by changing the location directive below to "/". An administrator may
  22. also wish to automatically log in visitors to Drupal; this can be achieved by
  23. checking "Turn on automated single sign-on" in the modules' configuration page.
  24. An example of an Apache configuration for a named virtualhost configuration
  25. using mod_auth_sspi on Windows is as follows:
  26. httpd.conf:
  27. _______________________________________________________________________________
  28. _______________________________________________________________________________
  29. # Virtual hosts
  30. Include conf/extra/httpd-vhosts.conf
  31. # Pass NTLM authentication to Apache
  32. LoadModule sspi_auth_module modules/mod_auth_sspi.so
  33. LoadModule sspi_auth_module modules/mod_auth_sspi.so
  34. _______________________________________________________________________________
  35. _______________________________________________________________________________
  36. httpd-vhosts.conf:
  37. _______________________________________________________________________________
  38. _______________________________________________________________________________
  39. NameVirtualHost example.com
  40. DocumentRoot "D:/www/example.com/htdocs"
  41. ServerName example.com
  42. Options Indexes FollowSymLinks MultiViews
  43. AllowOverride All
  44. Order Allow,Deny
  45. Allow from all
  46. AuthType SSPI
  47. AuthName "Example.com - Login using your LDAP user name and password"
  48. SSPIAuth On
  49. SSPIAuthoritative On
  50. ### The domain used to authenticate with LDAP; this should match the domain
  51. ### configured in the LDAP integration configuration within Drupal
  52. SSPIDomain ad.example.com
  53. SSPIOmitDomain On
  54. SSPIOfferBasic On
  55. Require valid-user
  56. #SSPIBasicPreferred On
  57. #SSPIofferSSPI off
  58. _______________________________________________________________________________
  59. _______________________________________________________________________________
  60. After enabling and configuring an LDAP authentication module within Apache,
  61. visit user/login/sso in the Drupal installation on example.com. With or without
  62. the ldap sso feature enabled, the browser should prompt for a user name and
  63. password if using Internet Explorer 8 or a non-Microsoft browser. Internet
  64. Explorer 7 by default will pass NTLM authentication credentials to local
  65. websites, and IE8 and Firefox can be configured to do this as well.
  66. If prompted for credentials on that path, enter a valid LDAP user name,
  67. omitting the domain if "SSPIOmitDomain On" is configured, as well as a password.
  68. If the credentials are correct, or if NTLM credentials are passed automatically
  69. by the browser and successfully authenticated, a Drupal 404 "Page not found"
  70. message will be displayed if the module is not enabled; an "access is denied"
  71. message will be displayed if the module is enabled and the browser is already
  72. logged in; and if the ldap_sso module is fully configured and there is no
  73. existing session, the browser will display the message "You have been
  74. successfully authenticated" after redirecting to the sites' home page if you
  75. have checked "Notify user of successful authentication".