Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #17111 > unrolled thread

Seamless SSO

Back to article view | Back to comp.lang.php

Contents

  Seamless SSO Tim Ritberg <tim@server.invalid> - 2016-10-02 11:37 +0200
    Re: Seamless SSO "Peter H. Coffin" <hellsop@ninehells.com> - 2016-10-04 12:44 -0500
      Re: Seamless SSO Tim Ritberg <tim@server.invalid> - 2016-10-04 20:12 +0200
    Re: Seamless SSO Arno Welzel <usenet@arnowelzel.de> - 2016-10-04 20:19 +0200
      Re: Seamless SSO Tim Ritberg <tim@server.invalid> - 2016-10-04 20:55 +0200
        Re: Seamless SSO Jerry Stuckle <jstucklex@attglobal.net> - 2016-10-04 20:47 -0400
          Re: Seamless SSO Tim Ritberg <tim@server.invalid> - 2016-10-05 09:52 +0200
            Re: Seamless SSO Jerry Stuckle <jstucklex@attglobal.net> - 2016-10-05 12:53 -0400
              Re: Seamless SSO Tim Ritberg <tim@server.invalid> - 2016-10-05 19:19 +0200
                Re: Seamless SSO Jerry Stuckle <jstucklex@attglobal.net> - 2016-10-05 14:35 -0400
                  Re: Seamless SSO Tim Ritberg <tim@server.invalid> - 2016-10-05 20:50 +0200
                    Re: Seamless SSO Jerry Stuckle <jstucklex@attglobal.net> - 2016-10-05 16:31 -0400
                      Re: Seamless SSO Tim Ritberg <tim@server.invalid> - 2016-10-07 09:50 +0200
                        Re: Seamless SSO Jerry Stuckle <jstucklex@attglobal.net> - 2016-10-07 10:48 -0400
                        Re: Seamless SSO Arno Welzel <usenet@arnowelzel.de> - 2016-10-07 17:44 +0200
                          Re: Seamless SSO Tim Ritberg <tim@server.invalid> - 2016-10-07 18:04 +0200
                            Re: Seamless SSO Jerry Stuckle <jstucklex@attglobal.net> - 2016-10-07 17:12 -0400
                              Re: Seamless SSO Tim Ritberg <tim@server.invalid> - 2016-10-24 12:33 +0200
                                Re: Seamless SSO Jerry Stuckle <jstucklex@attglobal.net> - 2016-10-24 08:22 -0400
                                  Re: Seamless SSO Tim Ritberg <tim@server.invalid> - 2016-10-24 15:51 +0200
                                    Re: Seamless SSO Jerry Stuckle <jstucklex@attglobal.net> - 2016-10-24 10:55 -0400
        Re: Seamless SSO Arno Welzel <usenet@arnowelzel.de> - 2016-10-07 17:47 +0200
          Re: Seamless SSO Tim Ritberg <tim@server.invalid> - 2016-10-07 18:07 +0200
            Re: Seamless SSO Jerry Stuckle <jstucklex@attglobal.net> - 2016-10-07 17:13 -0400
              Re: Seamless SSO Tim Ritberg <tim@server.invalid> - 2016-10-08 00:50 +0200
                Re: Seamless SSO Jerry Stuckle <jstucklex@attglobal.net> - 2016-10-07 19:42 -0400
                Re: Seamless SSO Arno Welzel <usenet@arnowelzel.de> - 2016-10-08 12:33 +0200
            Re: Seamless SSO Arno Welzel <usenet@arnowelzel.de> - 2016-10-08 12:31 +0200
              Re: Seamless SSO Tim Ritberg <tim@server.invalid> - 2016-10-08 13:19 +0200

Page 1 of 2  [1] 2  Next page →

#17111 — Seamless SSO

Hi!

How to develop a S-SSO for a PHP-page?
We are using Apache with PHP 5.5 and the Internet Explorer in a MS AD
network.

We tried to use www-authenticate with NTLM but we can't check against
LDAP, because AD does not provide the user password hash.

Any ideas to solve this problem?

TIm

[toc] | [next] | [standalone]

#17112

On Sun, 2 Oct 2016 11:37:50 +0200, Tim Ritberg wrote:
> Hi!
>
> How to develop a S-SSO for a PHP-page?
> We are using Apache with PHP 5.5 and the Internet Explorer in a MS AD
> network.
>
> We tried to use www-authenticate with NTLM but we can't check against
> LDAP, because AD does not provide the user password hash.
>
> Any ideas to solve this problem?

Are you maybe overthinking this? Shouldn't you just be passing the
submitted credentials along to the LDAP connection bind, and if it
works, you say "Hooray, you're logged in" and if it doesn't, you say
"Sorry, bad user/password combination"? That is, you don't do any hash
comparisons on your own, the LDAP service does it for you. Your only
responsibility is to pass off the submitted password as rapidly as
possible and forget about it.

-- 
46. If an advisor says to me "My liege, he is but one man. What can one
    man possibly do?", I will reply "This." and kill the advisor.
	--Peter Anspach's list of things to do as an Evil Overlord

[toc] | [prev] | [next] | [standalone]

#17113

Am 04.10.2016 um 19:44 schrieb Peter H. Coffin:

> 
> Are you maybe overthinking this? Shouldn't you just be passing the
> submitted credentials along to the LDAP connection bind, and if it
> works, you say "Hooray, you're logged in" and if it doesn't, you say
> "Sorry, bad user/password combination"? That is, you don't do any hash
> comparisons on your own, the LDAP service does it for you. Your only
> responsibility is to pass off the submitted password as rapidly as
> possible and forget about it.
> 
The submitted password is a hash. LDAP does not support login in with
hashes.

Tim

[toc] | [prev] | [next] | [standalone]

#17114

Tim Ritberg schrieb am 2016-10-02 um 11:37:

> How to develop a S-SSO for a PHP-page?
> We are using Apache with PHP 5.5 and the Internet Explorer in a MS AD
> network.
> 
> We tried to use www-authenticate with NTLM but we can't check against
> LDAP, because AD does not provide the user password hash.

When using NTLM then PHP does not do the authentication itself but
relies on the web server to do this for you. So there is no need to
authenticate against an LDAP server.

But if you indeed want to access an LDAP directory and need credentials
for this, you must not use NTLM but only a plain login form where you
get username/password you can use.



-- 
Arno Welzel
https://arnowelzel.de
http://de-rec-fahrrad.de
http://fahrradzukunft.de

[toc] | [prev] | [next] | [standalone]

#17115

Am 04.10.2016 um 20:19 schrieb Arno Welzel:
> Tim Ritberg schrieb am 2016-10-02 um 11:37:
> 
>> How to develop a S-SSO for a PHP-page?
>> We are using Apache with PHP 5.5 and the Internet Explorer in a MS AD
>> network.
>>
>> We tried to use www-authenticate with NTLM but we can't check against
>> LDAP, because AD does not provide the user password hash.
> 
> When using NTLM then PHP does not do the authentication itself but
> relies on the web server to do this for you. So there is no need to
> authenticate against an LDAP server.
This is not an option, because PHP should control the login process.
There has to be a fallback login option.

> 
> But if you indeed want to access an LDAP directory and need credentials
> for this, you must not use NTLM but only a plain login form where you
> get username/password you can use.
I know.

Tim

[toc] | [prev] | [next] | [standalone]

#17116

On 10/4/2016 2:55 PM, Tim Ritberg wrote:
> Am 04.10.2016 um 20:19 schrieb Arno Welzel:
>> Tim Ritberg schrieb am 2016-10-02 um 11:37:
>>
>>> How to develop a S-SSO for a PHP-page?
>>> We are using Apache with PHP 5.5 and the Internet Explorer in a MS AD
>>> network.
>>>
>>> We tried to use www-authenticate with NTLM but we can't check against
>>> LDAP, because AD does not provide the user password hash.
>>
>> When using NTLM then PHP does not do the authentication itself but
>> relies on the web server to do this for you. So there is no need to
>> authenticate against an LDAP server.
> This is not an option, because PHP should control the login process.
> There has to be a fallback login option.
>

Then you are screwed. As Arno indicated, PHP does not get the plain text
password.  You can use NTLM (in which case the web server handles the
login), or you can use PHP with a login form.

>>
>> But if you indeed want to access an LDAP directory and need credentials
>> for this, you must not use NTLM but only a plain login form where you
>> get username/password you can use.
> I know.
> 
> Tim
> 

Sorry.  One or the other.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#17117

Am 05.10.2016 um 02:47 schrieb Jerry Stuckle:
> On 10/4/2016 2:55 PM, Tim Ritberg wrote:
>> Am 04.10.2016 um 20:19 schrieb Arno Welzel:
>>> Tim Ritberg schrieb am 2016-10-02 um 11:37:
>>>
>>>> How to develop a S-SSO for a PHP-page?
>>>> We are using Apache with PHP 5.5 and the Internet Explorer in a MS AD
>>>> network.
>>>>
>>>> We tried to use www-authenticate with NTLM but we can't check against
>>>> LDAP, because AD does not provide the user password hash.
>>>
>>> When using NTLM then PHP does not do the authentication itself but
>>> relies on the web server to do this for you. So there is no need to
>>> authenticate against an LDAP server.
>> This is not an option, because PHP should control the login process.
>> There has to be a fallback login option.
>>
> 
> Then you are screwed. As Arno indicated, PHP does not get the plain text
> password.  You can use NTLM (in which case the web server handles the
> login), or you can use PHP with a login form.
> 
>>>
>>> But if you indeed want to access an LDAP directory and need credentials
>>> for this, you must not use NTLM but only a plain login form where you
>>> get username/password you can use.
>> I know.
>>
>> Tim
>>
> 
> Sorry.  One or the other.
> 

What about other ways for seamless SSO?
I read about Kerberos and SAML.

Tim

[toc] | [prev] | [next] | [standalone]

#17118

On 10/5/2016 3:52 AM, Tim Ritberg wrote:
> Am 05.10.2016 um 02:47 schrieb Jerry Stuckle:
>> On 10/4/2016 2:55 PM, Tim Ritberg wrote:
>>> Am 04.10.2016 um 20:19 schrieb Arno Welzel:
>>>> Tim Ritberg schrieb am 2016-10-02 um 11:37:
>>>>
>>>>> How to develop a S-SSO for a PHP-page?
>>>>> We are using Apache with PHP 5.5 and the Internet Explorer in a MS AD
>>>>> network.
>>>>>
>>>>> We tried to use www-authenticate with NTLM but we can't check against
>>>>> LDAP, because AD does not provide the user password hash.
>>>>
>>>> When using NTLM then PHP does not do the authentication itself but
>>>> relies on the web server to do this for you. So there is no need to
>>>> authenticate against an LDAP server.
>>> This is not an option, because PHP should control the login process.
>>> There has to be a fallback login option.
>>>
>>
>> Then you are screwed. As Arno indicated, PHP does not get the plain text
>> password.  You can use NTLM (in which case the web server handles the
>> login), or you can use PHP with a login form.
>>
>>>>
>>>> But if you indeed want to access an LDAP directory and need credentials
>>>> for this, you must not use NTLM but only a plain login form where you
>>>> get username/password you can use.
>>> I know.
>>>
>>> Tim
>>>
>>
>> Sorry.  One or the other.
>>
> 
> What about other ways for seamless SSO?
> I read about Kerberos and SAML.
> 
> Tim
> 

Then you need to read more to find out why they won't do what you need.

But you're asking the wrong question.  Why do you think you need PHP to
do the authorization?

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#17119

Am 05.10.2016 um 18:53 schrieb Jerry Stuckle:
>>
> 
> Then you need to read more to find out why they won't do what you need.
> 
> But you're asking the wrong question.  Why do you think you need PHP to
> do the authorization?
Because the website is written in PHP.

Tim

[toc] | [prev] | [next] | [standalone]

#17120

On 10/5/2016 1:19 PM, Tim Ritberg wrote:
> Am 05.10.2016 um 18:53 schrieb Jerry Stuckle:
>>>
>>
>> Then you need to read more to find out why they won't do what you need.
>>
>> But you're asking the wrong question.  Why do you think you need PHP to
>> do the authorization?
> Because the website is written in PHP.
> 
> Tim
> 
> 

So?  That fails to answer the question.  Why do you think you need PHP
to do the authorization?

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#17121

Am 05.10.2016 um 20:35 schrieb Jerry Stuckle:
> 
> So?  That fails to answer the question.  Why do you think you need PHP
> to do the authorization?
As I said:
"...because PHP should control the login process.
There has to be a fallback login option."

Tim

[toc] | [prev] | [next] | [standalone]

#17122

On 10/5/2016 2:50 PM, Tim Ritberg wrote:
> Am 05.10.2016 um 20:35 schrieb Jerry Stuckle:
>>
>> So?  That fails to answer the question.  Why do you think you need PHP
>> to do the authorization?
> As I said:
> "...because PHP should control the login process.
> There has to be a fallback login option."
> 
> Tim
> 
> 

Again - why should PHP control the login process?  SSO is normally
handled by the server - which is why you don't get a plain-text password
(security exposure).'

Fallback would be a form, as Arno indicated.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#17123

Am 05.10.2016 um 22:31 schrieb Jerry Stuckle:
> Again - why should PHP control the login process?  SSO is normally
> handled by the server - which is why you don't get a plain-text password
> (security exposure).'
> 
> Fallback would be a form, as Arno indicated.
> 

How to design a fallback scenario with an Apache Auth Module?
Those modules give back 403.

Tim

[toc] | [prev] | [next] | [standalone]

#17124

On 10/7/2016 3:50 AM, Tim Ritberg wrote:
> Am 05.10.2016 um 22:31 schrieb Jerry Stuckle:
>> Again - why should PHP control the login process?  SSO is normally
>> handled by the server - which is why you don't get a plain-text password
>> (security exposure).'
>>
>> Fallback would be a form, as Arno indicated.
>>
> 
> How to design a fallback scenario with an Apache Auth Module?
> Those modules give back 403.
> 
> Tim
> 

There is no fallback to a 403.  Processing stops at that time.

You need to find someone who knows how to properly configure your
server. This isn't a PHP problem, and in any case would be more than
could be handled in a newsgroup.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#17125

Tim Ritberg schrieb am 2016-10-07 um 09:50:
> Am 05.10.2016 um 22:31 schrieb Jerry Stuckle:
>> Again - why should PHP control the login process?  SSO is normally
>> handled by the server - which is why you don't get a plain-text password
>> (security exposure).'
>>
>> Fallback would be a form, as Arno indicated.
>>
> 
> How to design a fallback scenario with an Apache Auth Module?
> Those modules give back 403.

There is no fallback, because Apache *must* authenticate the user
*before* it will pass the query to PHP.

If you don't want this, then you have to implement your own
authentication in PHP which *must* be used *always* then.


-- 
Arno Welzel
https://arnowelzel.de
http://de-rec-fahrrad.de
http://fahrradzukunft.de

[toc] | [prev] | [next] | [standalone]

#17127

Am 07.10.2016 um 17:44 schrieb Arno Welzel:
> 
> There is no fallback, because Apache *must* authenticate the user
> *before* it will pass the query to PHP.
> 
> If you don't want this, then you have to implement your own
> authentication in PHP which *must* be used *always* then.
As I said before.

[toc] | [prev] | [next] | [standalone]

#17129

On 10/7/2016 12:04 PM, Tim Ritberg wrote:
> Am 07.10.2016 um 17:44 schrieb Arno Welzel:
>>
>> There is no fallback, because Apache *must* authenticate the user
>> *before* it will pass the query to PHP.
>>
>> If you don't want this, then you have to implement your own
>> authentication in PHP which *must* be used *always* then.
> As I said before.
> 

Which means you need to use a sign in form.  But it will not be a
"fall-back".  It will be your means of authentication.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#17141

Am 07.10.2016 um 23:12 schrieb Jerry Stuckle:

> Which means you need to use a sign in form.  But it will not be a
> "fall-back".  It will be your means of authentication.
> 

I got it work...

[toc] | [prev] | [next] | [standalone]

#17142

On 10/24/2016 6:33 AM, Tim Ritberg wrote:
> Am 07.10.2016 um 23:12 schrieb Jerry Stuckle:
> 
>> Which means you need to use a sign in form.  But it will not be a
>> "fall-back".  It will be your means of authentication.
>>
> 
> I got it work...
> 

Let me guess.  You got your Apache configuration set up properly.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#17143

Am 24.10.2016 um 14:22 schrieb Jerry Stuckle:
> On 10/24/2016 6:33 AM, Tim Ritberg wrote:
>> Am 07.10.2016 um 23:12 schrieb Jerry Stuckle:
>>
>>> Which means you need to use a sign in form.  But it will not be a
>>> "fall-back".  It will be your means of authentication.
>>>
>>
>> I got it work...
>>
> 
> Let me guess.  You got your Apache configuration set up properly.
> 

no.

[toc] | [prev] | [next] | [standalone]

Page 1 of 2  [1] 2  Next page →

Back to top | Article view | comp.lang.php

csiph-web