0

Under Apache server I'm trying make ntlm authentication (sso with windows domain) for web pages, but I want revoke basic/digest authentication. It is possible? Must I write wrapper?

For config below all works properly. When I connect by InternetExplorer, this use NTLM by default and can access pages any way.

Currently unconfigured for domain access Firefox prompts me using popup for credentials and this works ok. I want prevent this, because this uses basic or digest authentication. For that authentication I don't want popup, but deny web page.

How can I do it? Any ideas? Should I write some wrapper for ntlm_auth ? What wrapper should do?

Sample config:

<Directory /var/www/>
  #defaults for main www directory
  Options Indexes FollowSymLinks MultiViews
  AllowOverride None
  #modified, prevent for any ip access
  Order deny,allow
  deny from all
  #settings for NTLM auth with winbind helper
  AuthName "NTLM Authentication"
  NTLMAuth on
  NTLMAuthHelper "/usr/bin/ntlm_auth  --domain=MY.WINDOWS.DOMAIN --helper-protocol=squid-2.5-ntlmssp"
  NTLMBasicAuthoritative on
  AuthType NTLM
  require valid-user
  #because ip is default deny
  satisfy any
</Directory>
2
  • I see nobody know how resolve this :( In other way, is it possible make redirections based on authtype?
    – Znik
    Feb 7, 2014 at 12:13
  • Someone shows me, I do a mistake. client allways use ntlm. when credentials are impossible to get from station api, then prompt user for them. In this way it's impossible by web server, user is prompted or not for credentials. Redirection based on auth type is available. We can use RewriteCond %{AUTH_TYPE} ^NTLM$ with some rewriterule. unfortunately authtype is allways ntlm. It is impossible to revert back from ntlm to basic type, then mixing auths are unavailable.
    – Znik
    Feb 18, 2014 at 13:31

0

You must log in to answer this question.

Browse other questions tagged .