» Enable Windows NTLM Pass-through Authentication in Linux-based Apache

1Oct/093

Enable Windows NTLM Pass-through Authentication in Linux-based Apache

Thank Science for SuSE Linux Enterprise 11; it's made this process relatively easy. SLES 10 SP2 was giving me a headache because of some Windows 2008 based Active Directory authentication issues but upgrading SLES 11 took care of all that.

First thing is first, setup samba to authenticate to AD. Next, install the OpenSuSE mod_auth_ntlm_winbind RPM.

rpm --install http://download.opensuse.org/distribution/11.0/repo/oss/suse/i586/apache2-mod_auth_ntlm_winbind-0.0.0.lorikeet_svn_682-135.1.i586.rpm

The wiki for this Apache 2 module can be found here. Next, we're going to instasll pam_smb, set the proper permissions on winbindd_privileged, add the module to apache and restart the web service.

yast -i pam_smb

setfacl -m u:wwwrun:rx /var/lib/samba/winbindd_privileged

a2enmod auth_ntlm_winbind

rcapache2 restart

Finally, add something to the effect of this to your Apache config file:

<directory " /srv/www/htdocs">

  AuthName "NTLM Authentication"

  NTLMAuth on

  NTLMAuthHelper "/usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp"

  NTLMBasicAuthoritative on

  AuthType NTLM

  require valid-user

</directory>

Restart the service and you should be authenticating automatically. Don't forget to add the website to your browser's Intranet zone if needed.

Also, I read that, unfortunately, auth_ntlm_winbind, doesn't work over SSL but I'm going to try it anyway. In the event that it doesn't, I'll be exploring Kerberos authentication within Apache.

Posted by: Chrissy Filed under: Active Directory, Apache, Linux, Security Leave a comment

Comments (3) Trackbacks (0) ( subscribe to comments on this post )

Maxwell
December 13th, 2009 - 11:44

Any luck with auth_ntlm_winbind and SSL?

( REPLY )
Chrissy
December 18th, 2009 - 17:11

Negative. I ended up using Likewise. Check out http://blog.netnerds.net/category/security/ for more details.

( REPLY )
Gavin Jackson
July 1st, 2010 - 01:09

Thanks for this post, it was most useful. I’ve tested this auth method over ssl and can confirm that it doesn’t work on IE 8 (get a 500 server error). It does however seem to work fine in Firefox 3.6.3.

To white list ntlm servers in recent versions of firefox (for password-less authentication on windows), you need to use about:config and edit the network.automatic-ntlm-auth.trusted-uris option (enter your webserver name).

( REPLY )