Under Apache server I'm trying make ntlm authentication (sso with windows domain) for web pages, but I want revoke basic/digest authentication. It is possible? Must I write wrapper?
For config below all works properly. When I connect by InternetExplorer, this use NTLM by default and can access pages any way.
Currently unconfigured for domain access Firefox prompts me using popup for credentials and this works ok. I want prevent this, because this uses basic or digest authentication. For that authentication I don't want popup, but deny web page.
How can I do it? Any ideas? Should I write some wrapper for ntlm_auth ? What wrapper should do?
Sample config:
<Directory /var/www/>
#defaults for main www directory
Options Indexes FollowSymLinks MultiViews
AllowOverride None
#modified, prevent for any ip access
Order deny,allow
deny from all
#settings for NTLM auth with winbind helper
AuthName "NTLM Authentication"
NTLMAuth on
NTLMAuthHelper "/usr/bin/ntlm_auth --domain=MY.WINDOWS.DOMAIN --helper-protocol=squid-2.5-ntlmssp"
NTLMBasicAuthoritative on
AuthType NTLM
require valid-user
#because ip is default deny
satisfy any
</Directory>