Re: Seamless SSO

From	Tim Ritberg <tim@server.invalid>
Newsgroups	comp.lang.php
Subject	Re: Seamless SSO
Date	2016-10-05 09:52 +0200
Organization	TOTA
Message-ID	<nt2bfn$617$2@tota-refugium.de> (permalink)
References	<nsqkhe$2cj$1@tota-refugium.de> <db89f13b-a26f-1fa8-aaf1-42aebded3dec@arnowelzel.de> <nt0tuk$a9q$1@tota-refugium.de> <nt1ii0$ksq$1@jstuckle.eternal-september.org>

Show all headers | View raw

Am 05.10.2016 um 02:47 schrieb Jerry Stuckle:
> On 10/4/2016 2:55 PM, Tim Ritberg wrote:
>> Am 04.10.2016 um 20:19 schrieb Arno Welzel:
>>> Tim Ritberg schrieb am 2016-10-02 um 11:37:
>>>
>>>> How to develop a S-SSO for a PHP-page?
>>>> We are using Apache with PHP 5.5 and the Internet Explorer in a MS AD
>>>> network.
>>>>
>>>> We tried to use www-authenticate with NTLM but we can't check against
>>>> LDAP, because AD does not provide the user password hash.
>>>
>>> When using NTLM then PHP does not do the authentication itself but
>>> relies on the web server to do this for you. So there is no need to
>>> authenticate against an LDAP server.
>> This is not an option, because PHP should control the login process.
>> There has to be a fallback login option.
>>
> 
> Then you are screwed. As Arno indicated, PHP does not get the plain text
> password.  You can use NTLM (in which case the web server handles the
> login), or you can use PHP with a login form.
> 
>>>
>>> But if you indeed want to access an LDAP directory and need credentials
>>> for this, you must not use NTLM but only a plain login form where you
>>> get username/password you can use.
>> I know.
>>
>> Tim
>>
> 
> Sorry.  One or the other.
> 

What about other ways for seamless SSO?
I read about Kerberos and SAML.

Tim

Thread

Seamless SSO Tim Ritberg <tim@server.invalid> - 2016-10-02 11:37 +0200
  Re: Seamless SSO "Peter H. Coffin" <hellsop@ninehells.com> - 2016-10-04 12:44 -0500
    Re: Seamless SSO Tim Ritberg <tim@server.invalid> - 2016-10-04 20:12 +0200
  Re: Seamless SSO Arno Welzel <usenet@arnowelzel.de> - 2016-10-04 20:19 +0200
    Re: Seamless SSO Tim Ritberg <tim@server.invalid> - 2016-10-04 20:55 +0200
      Re: Seamless SSO Jerry Stuckle <jstucklex@attglobal.net> - 2016-10-04 20:47 -0400
        Re: Seamless SSO Tim Ritberg <tim@server.invalid> - 2016-10-05 09:52 +0200
          Re: Seamless SSO Jerry Stuckle <jstucklex@attglobal.net> - 2016-10-05 12:53 -0400
            Re: Seamless SSO Tim Ritberg <tim@server.invalid> - 2016-10-05 19:19 +0200
              Re: Seamless SSO Jerry Stuckle <jstucklex@attglobal.net> - 2016-10-05 14:35 -0400
                Re: Seamless SSO Tim Ritberg <tim@server.invalid> - 2016-10-05 20:50 +0200
                Re: Seamless SSO Jerry Stuckle <jstucklex@attglobal.net> - 2016-10-05 16:31 -0400
                Re: Seamless SSO Tim Ritberg <tim@server.invalid> - 2016-10-07 09:50 +0200
                Re: Seamless SSO Jerry Stuckle <jstucklex@attglobal.net> - 2016-10-07 10:48 -0400
                Re: Seamless SSO Arno Welzel <usenet@arnowelzel.de> - 2016-10-07 17:44 +0200
                Re: Seamless SSO Tim Ritberg <tim@server.invalid> - 2016-10-07 18:04 +0200
                Re: Seamless SSO Jerry Stuckle <jstucklex@attglobal.net> - 2016-10-07 17:12 -0400
                Re: Seamless SSO Tim Ritberg <tim@server.invalid> - 2016-10-24 12:33 +0200
                Re: Seamless SSO Jerry Stuckle <jstucklex@attglobal.net> - 2016-10-24 08:22 -0400
                Re: Seamless SSO Tim Ritberg <tim@server.invalid> - 2016-10-24 15:51 +0200
                Re: Seamless SSO Jerry Stuckle <jstucklex@attglobal.net> - 2016-10-24 10:55 -0400
      Re: Seamless SSO Arno Welzel <usenet@arnowelzel.de> - 2016-10-07 17:47 +0200
        Re: Seamless SSO Tim Ritberg <tim@server.invalid> - 2016-10-07 18:07 +0200
          Re: Seamless SSO Jerry Stuckle <jstucklex@attglobal.net> - 2016-10-07 17:13 -0400
            Re: Seamless SSO Tim Ritberg <tim@server.invalid> - 2016-10-08 00:50 +0200
              Re: Seamless SSO Jerry Stuckle <jstucklex@attglobal.net> - 2016-10-07 19:42 -0400
              Re: Seamless SSO Arno Welzel <usenet@arnowelzel.de> - 2016-10-08 12:33 +0200
          Re: Seamless SSO Arno Welzel <usenet@arnowelzel.de> - 2016-10-08 12:31 +0200
            Re: Seamless SSO Tim Ritberg <tim@server.invalid> - 2016-10-08 13:19 +0200

csiph-web