Apache authentication: NTLM Single Signon - Revision history

Bbbhltz: very minor formatting and reference to Apache page, proposal for merge with Apache page

2023-05-14T16:46:04Z

very minor formatting and reference to Apache page, proposal for merge with Apache page

← Older revision		Revision as of 16:46, 14 May 2023
Line 1:		Line 1:
	NTLM single sign on under Apache		{{Merge\|Apache\|Everything in one place seems logical}}

			NTLM single sign on under [[Apache]]

	{{Note\|This guide assumes you have Samba configured and connected to a Windows domain}}		{{Note\|This guide assumes you have Samba configured and connected to a Windows domain}}

			== Installation and Configuration ==

	Install needed packages:		Install needed packages:
Line 12:		Line 16:

	add to httpd.conf (virtual host):		add to httpd.conf (virtual host):

	{{cat\|/etc/apache2/httpd.conf\|<nowiki># /etc/apache2/httpd.conf		{{cat\|/etc/apache2/httpd.conf\|<nowiki># /etc/apache2/httpd.conf

Astrawso at 18:08, 7 December 2018

2018-12-07T18:08:31Z

← Older revision		Revision as of 18:08, 7 December 2018
Line 12:		Line 12:

	add to httpd.conf (virtual host):		add to httpd.conf (virtual host):
	{{cat\|/etc/apache2/httpd.conf\|<nowiki>AuthType NTLM		{{cat\|/etc/apache2/httpd.conf\|<nowiki># /etc/apache2/httpd.conf

			AuthType NTLM
	NTLMauth on		NTLMauth on
	NTLMAuthHelper "/usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp"		NTLMAuthHelper "/usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp"
Line 23:		Line 25:
	Alternatively, allow all valid users who are members of the winbind domain with the following:		Alternatively, allow all valid users who are members of the winbind domain with the following:

	{{cat\|/etc/apache2/httpd.conf\|<nowiki>#/etc/apache2/httpd.conf		{{cat\|/etc/apache2/httpd.conf\|<nowiki># /etc/apache2/httpd.conf

	AuthType NTLM		AuthType NTLM
	NTLMauth on		NTLMauth on

Astrawso at 18:07, 7 December 2018

2018-12-07T18:07:04Z

← Older revision		Revision as of 18:07, 7 December 2018
Line 12:		Line 12:

	add to httpd.conf (virtual host):		add to httpd.conf (virtual host):
	{{cat\|/etc/apache2/httpd.conf\|AuthType NTLM		{{cat\|/etc/apache2/httpd.conf\|<nowiki>AuthType NTLM
	NTLMauth on		NTLMauth on
	NTLMAuthHelper "/usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp"		NTLMAuthHelper "/usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp"
	Require user <users>		Require user <users>
			</nowiki>
	}}		}}

Line 22:		Line 23:
	Alternatively, allow all valid users who are members of the winbind domain with the following:		Alternatively, allow all valid users who are members of the winbind domain with the following:

	<~~pre~~>AuthType NTLM		{{cat\|/etc/apache2/httpd.conf\|<nowiki>#/etc/apache2/httpd.conf
			AuthType NTLM
	NTLMauth on		NTLMauth on
	NTLMAuthHelper "/usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp -require-membership-of="WORKGROUP\Domain Users""		NTLMAuthHelper "/usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp -require-membership-of="WORKGROUP\Domain Users""
	Require valid user		Require valid user
	</~~pre~~>		</nowiki>
			}}

	Restart ~~apache~~ and test:		Restart Apache and test:

	{{cmd\|# rc-service ~~apache stop && rc-service apache start~~}}		{{cmd\|# rc-service apache2 restart}}

Astrawso at 18:04, 7 December 2018

2018-12-07T18:04:03Z

← Older revision		Revision as of 18:04, 7 December 2018
Line 12:		Line 12:

	add to httpd.conf (virtual host):		add to httpd.conf (virtual host):
	~~<pre>~~AuthType NTLM		{{cat\|/etc/apache2/httpd.conf\|AuthType NTLM
	NTLMauth on		NTLMauth on
	NTLMAuthHelper "/usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp"		NTLMAuthHelper "/usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp"
	Require user <users>		Require user <users>
	~~</pre>~~		}}

	Ensure that all users requiring authentication are added to the last line.		Ensure that all users requiring authentication are added to the last line.

Astrawso at 17:52, 7 December 2018

2018-12-07T17:52:36Z

← Older revision		Revision as of 17:52, 7 December 2018
Line 15:		Line 15:
	NTLMauth on		NTLMauth on
	NTLMAuthHelper "/usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp"		NTLMAuthHelper "/usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp"
	Require user <user>		Require user <users>
			</pre>

			Ensure that all users requiring authentication are added to the last line.

			Alternatively, allow all valid users who are members of the winbind domain with the following:

			<pre>AuthType NTLM
			NTLMauth on
			NTLMAuthHelper "/usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp -require-membership-of="WORKGROUP\Domain Users""
			Require valid user
	</pre>		</pre>
	Don't forget to customize the final line with the username(s) that you wish to limit usage to. Alternatively, make the final line "Require valid user" and change the helper line to include something like -require-membership-of="WORKGROUP\Domain Users"

	Restart apache and test:		Restart apache and test:

Astrawso at 17:49, 7 December 2018

2018-12-07T17:49:40Z

← Older revision		Revision as of 17:49, 7 December 2018
Line 17:		Line 17:
	Require user <user>		Require user <user>
	</pre>		</pre>
	Don't forget to customize the final line with the username(s) that you wish to limit usage to. Alternatively, make the final line "Require valid user" and change the helper line to include something like ~~{{cmd\|~~-require-membership-of="WORKGROUP\Domain Users"}}		Don't forget to customize the final line with the username(s) that you wish to limit usage to. Alternatively, make the final line "Require valid user" and change the helper line to include something like -require-membership-of="WORKGROUP\Domain Users"

	Restart apache and test:		Restart apache and test:

Astrawso at 17:49, 7 December 2018

2018-12-07T17:49:09Z

← Older revision		Revision as of 17:49, 7 December 2018
Line 17:		Line 17:
	Require user <user>		Require user <user>
	</pre>		</pre>
	Don't forget to customize the final line with the username(s) that you wish to limit usage to. Alternatively, make the final line "Require valid user" and change the helper line to include something like {{cmd\|"-require-membership-of="WORKGROUP\Domain Users""}}		Don't forget to customize the final line with the username(s) that you wish to limit usage to. Alternatively, make the final line "Require valid user" and change the helper line to include something like {{cmd\|-require-membership-of="WORKGROUP\Domain Users"}}

	Restart apache and test:		Restart apache and test:

Astrawso at 17:48, 7 December 2018

2018-12-07T17:48:38Z

← Older revision		Revision as of 17:48, 7 December 2018
Line 1:		Line 1:
	NTLM single sign on under Apache~~<br />~~		NTLM single sign on under Apache
	Install needed packages ~~(you will need both the main and testing repositories from edge)~~:~~<br />~~
	apache2~~<br />~~		{{Note\|This guide assumes you have Samba configured and connected to a Windows domain}}
	apache-mod-auth-ntlm-winbind~~<br />~~
	~~samba (joined to a Windows Domain) with winbind running<br />~~		Install needed packages:
	~~<br />~~
	~~add~~ apache user to winbind group<~~br /~~>		{{cmd\|# apk add apache2 apache-mod-auth-ntlm-winbind}}
	~~Note: This howto does not show how to join Samba to a Windows domain, only how to setup the Apache authentication helper that uses the NTLM protocol while authenticating to such a domain.~~
	add to httpd.conf (virtual host):<~~br /~~>		Add apache user to winbind group:
	AuthType NTLM~~<br />~~
	NTLMauth on~~<br />~~		{{cmd\|# addgroup <user> winbind}}
	NTLMAuthHelper "/usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp"<~~br /~~>
	~~Require user jbilyk~~<br />		add to httpd.conf (virtual host):
	Don't forget to customize the final line with the username(s) that you wish to limit usage to. Alternatively, make the final line "Require valid user" and change the helper line to ~~inlude~~ something like "-require-membership-of="WORKGROUP\Domain Users""~~.<br />~~		<pre>AuthType NTLM
	Restart apache and test~~<br />~~		NTLMauth on
			NTLMAuthHelper "/usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp"
			Require user <user>
			</pre>
			Don't forget to customize the final line with the username(s) that you wish to limit usage to. Alternatively, make the final line "Require valid user" and change the helper line to include something like {{cmd\|"-require-membership-of="WORKGROUP\Domain Users""}}

			Restart apache and test:

			{{cmd\|# rc-service apache stop && rc-service apache start}}



	[[Category:Authentication]]		[[Category:Authentication]]
	[[Category:Web Server]]		[[Category:Web Server]]

John3-16: New categories: Authentication, Web Server

2017-09-21T03:31:58Z

New categories: Authentication, Web Server

← Older revision		Revision as of 03:31, 21 September 2017
Line 15:		Line 15:
	Restart apache and test<br />		Restart apache and test<br />

	[[Category:Server]]		[[Category:Authentication]]
			[[Category:Web Server]]

Dubiousjim: Category:Server

2012-03-24T16:48:27Z

Category:Server

← Older revision		Revision as of 16:48, 24 March 2012
Line 15:		Line 15:
	Restart apache and test<br />		Restart apache and test<br />

	[[Category:~~Networking~~]]		[[Category:Server]]