Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #17111 > unrolled thread

Seamless SSO

Started byTim Ritberg <tim@server.invalid>
First post2016-10-02 11:37 +0200
Last post2016-10-08 13:19 +0200
Articles 9 on this page of 29 — 4 participants

Back to article view | Back to comp.lang.php

Contents

  Seamless SSO Tim Ritberg <tim@server.invalid> - 2016-10-02 11:37 +0200
    Re: Seamless SSO "Peter H. Coffin" <hellsop@ninehells.com> - 2016-10-04 12:44 -0500
      Re: Seamless SSO Tim Ritberg <tim@server.invalid> - 2016-10-04 20:12 +0200
    Re: Seamless SSO Arno Welzel <usenet@arnowelzel.de> - 2016-10-04 20:19 +0200
      Re: Seamless SSO Tim Ritberg <tim@server.invalid> - 2016-10-04 20:55 +0200
        Re: Seamless SSO Jerry Stuckle <jstucklex@attglobal.net> - 2016-10-04 20:47 -0400
          Re: Seamless SSO Tim Ritberg <tim@server.invalid> - 2016-10-05 09:52 +0200
            Re: Seamless SSO Jerry Stuckle <jstucklex@attglobal.net> - 2016-10-05 12:53 -0400
              Re: Seamless SSO Tim Ritberg <tim@server.invalid> - 2016-10-05 19:19 +0200
                Re: Seamless SSO Jerry Stuckle <jstucklex@attglobal.net> - 2016-10-05 14:35 -0400
                  Re: Seamless SSO Tim Ritberg <tim@server.invalid> - 2016-10-05 20:50 +0200
                    Re: Seamless SSO Jerry Stuckle <jstucklex@attglobal.net> - 2016-10-05 16:31 -0400
                      Re: Seamless SSO Tim Ritberg <tim@server.invalid> - 2016-10-07 09:50 +0200
                        Re: Seamless SSO Jerry Stuckle <jstucklex@attglobal.net> - 2016-10-07 10:48 -0400
                        Re: Seamless SSO Arno Welzel <usenet@arnowelzel.de> - 2016-10-07 17:44 +0200
                          Re: Seamless SSO Tim Ritberg <tim@server.invalid> - 2016-10-07 18:04 +0200
                            Re: Seamless SSO Jerry Stuckle <jstucklex@attglobal.net> - 2016-10-07 17:12 -0400
                              Re: Seamless SSO Tim Ritberg <tim@server.invalid> - 2016-10-24 12:33 +0200
                                Re: Seamless SSO Jerry Stuckle <jstucklex@attglobal.net> - 2016-10-24 08:22 -0400
                                  Re: Seamless SSO Tim Ritberg <tim@server.invalid> - 2016-10-24 15:51 +0200
                                    Re: Seamless SSO Jerry Stuckle <jstucklex@attglobal.net> - 2016-10-24 10:55 -0400
        Re: Seamless SSO Arno Welzel <usenet@arnowelzel.de> - 2016-10-07 17:47 +0200
          Re: Seamless SSO Tim Ritberg <tim@server.invalid> - 2016-10-07 18:07 +0200
            Re: Seamless SSO Jerry Stuckle <jstucklex@attglobal.net> - 2016-10-07 17:13 -0400
              Re: Seamless SSO Tim Ritberg <tim@server.invalid> - 2016-10-08 00:50 +0200
                Re: Seamless SSO Jerry Stuckle <jstucklex@attglobal.net> - 2016-10-07 19:42 -0400
                Re: Seamless SSO Arno Welzel <usenet@arnowelzel.de> - 2016-10-08 12:33 +0200
            Re: Seamless SSO Arno Welzel <usenet@arnowelzel.de> - 2016-10-08 12:31 +0200
              Re: Seamless SSO Tim Ritberg <tim@server.invalid> - 2016-10-08 13:19 +0200

Page 2 of 2 — ← Prev page 1 [2]

#17144

FromJerry Stuckle <jstucklex@attglobal.net>
Date2016-10-24 10:55 -0400
Message-ID<nul7bo$5io$2@jstuckle.eternal-september.org>
In reply to#17143
On 10/24/2016 9:51 AM, Tim Ritberg wrote:
> Am 24.10.2016 um 14:22 schrieb Jerry Stuckle:
>> On 10/24/2016 6:33 AM, Tim Ritberg wrote:
>>> Am 07.10.2016 um 23:12 schrieb Jerry Stuckle:
>>>
>>>> Which means you need to use a sign in form.  But it will not be a
>>>> "fall-back".  It will be your means of authentication.
>>>>
>>>
>>> I got it work...
>>>
>>
>> Let me guess.  You got your Apache configuration set up properly.
>>
> 
> no.
> 

So how did you do it?  I know you didn't do it in PHP, because if Apache
rejects the request due to a failed authorization, the PHP code never
gets control.  To allow that to happen would be a huge security violation.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#17126

FromArno Welzel <usenet@arnowelzel.de>
Date2016-10-07 17:47 +0200
Message-ID<c6e17376-38f9-cc56-5ff2-25091101a752@arnowelzel.de>
In reply to#17115
Tim Ritberg schrieb am 2016-10-04 um 20:55:

> Am 04.10.2016 um 20:19 schrieb Arno Welzel:
>> Tim Ritberg schrieb am 2016-10-02 um 11:37:
>>
>>> How to develop a S-SSO for a PHP-page?
>>> We are using Apache with PHP 5.5 and the Internet Explorer in a MS AD
>>> network.
>>>
>>> We tried to use www-authenticate with NTLM but we can't check against
>>> LDAP, because AD does not provide the user password hash.
>>
>> When using NTLM then PHP does not do the authentication itself but
>> relies on the web server to do this for you. So there is no need to
>> authenticate against an LDAP server.
> This is not an option, because PHP should control the login process.
> There has to be a fallback login option.
> 
>>
>> But if you indeed want to access an LDAP directory and need credentials
>> for this, you must not use NTLM but only a plain login form where you
>> get username/password you can use.
> I know.

Then do it this way. If you need examples how to authenticate against an
AD server have a look at the DokuWiki authentication modules:

<https://www.dokuwiki.org/auth:ldap>
<https://www.dokuwiki.org/auth:ldap_ad>
<https://github.com/splitbrain/dokuwiki/tree/master/lib/plugins/authad>


-- 
Arno Welzel
https://arnowelzel.de
http://de-rec-fahrrad.de
http://fahrradzukunft.de

[toc] | [prev] | [next] | [standalone]

#17128

FromTim Ritberg <tim@server.invalid>
Date2016-10-07 18:07 +0200
Message-ID<nt8h76$7jq$2@tota-refugium.de>
In reply to#17126
Am 07.10.2016 um 17:47 schrieb Arno Welzel:
> 
> Then do it this way. If you need examples how to authenticate against an
> AD server have a look at the DokuWiki authentication modules:
> 
> <https://www.dokuwiki.org/auth:ldap>
> <https://www.dokuwiki.org/auth:ldap_ad>
> <https://github.com/splitbrain/dokuwiki/tree/master/lib/plugins/authad>
This is not seamless.


Tim

[toc] | [prev] | [next] | [standalone]

#17130

FromJerry Stuckle <jstucklex@attglobal.net>
Date2016-10-07 17:13 -0400
Message-ID<nt934m$gak$2@jstuckle.eternal-september.org>
In reply to#17128
On 10/7/2016 12:07 PM, Tim Ritberg wrote:
> Am 07.10.2016 um 17:47 schrieb Arno Welzel:
>>
>> Then do it this way. If you need examples how to authenticate against an
>> AD server have a look at the DokuWiki authentication modules:
>>
>> <https://www.dokuwiki.org/auth:ldap>
>> <https://www.dokuwiki.org/auth:ldap_ad>
>> <https://github.com/splitbrain/dokuwiki/tree/master/lib/plugins/authad>
> This is not seamless.
> 
> 
> Tim
> 

Like it or not, that's your choice.  You can take it or you can leave it.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#17131

FromTim Ritberg <tim@server.invalid>
Date2016-10-08 00:50 +0200
Message-ID<nt98s0$nu6$1@tota-refugium.de>
In reply to#17130
Am 07.10.2016 um 23:13 schrieb Jerry Stuckle:
> On 10/7/2016 12:07 PM, Tim Ritberg wrote:
>> Am 07.10.2016 um 17:47 schrieb Arno Welzel:
>>>
>>> Then do it this way. If you need examples how to authenticate against an
>>> AD server have a look at the DokuWiki authentication modules:
>>>
>>> <https://www.dokuwiki.org/auth:ldap>
>>> <https://www.dokuwiki.org/auth:ldap_ad>
>>> <https://github.com/splitbrain/dokuwiki/tree/master/lib/plugins/authad>
>> This is not seamless.
>>
>>
>> Tim
>>
> 
> Like it or not, that's your choice.  You can take it or you can leave it.
> 

What about other ways? I heard of SAML.

Tim

[toc] | [prev] | [next] | [standalone]

#17132

FromJerry Stuckle <jstucklex@attglobal.net>
Date2016-10-07 19:42 -0400
Message-ID<nt9btj$dr8$1@jstuckle.eternal-september.org>
In reply to#17131
On 10/7/2016 6:50 PM, Tim Ritberg wrote:
> Am 07.10.2016 um 23:13 schrieb Jerry Stuckle:
>> On 10/7/2016 12:07 PM, Tim Ritberg wrote:
>>> Am 07.10.2016 um 17:47 schrieb Arno Welzel:
>>>>
>>>> Then do it this way. If you need examples how to authenticate against an
>>>> AD server have a look at the DokuWiki authentication modules:
>>>>
>>>> <https://www.dokuwiki.org/auth:ldap>
>>>> <https://www.dokuwiki.org/auth:ldap_ad>
>>>> <https://github.com/splitbrain/dokuwiki/tree/master/lib/plugins/authad>
>>> This is not seamless.
>>>
>>>
>>> Tim
>>>
>>
>> Like it or not, that's your choice.  You can take it or you can leave it.
>>
> 
> What about other ways? I heard of SAML.
> 
> Tim
> 

You can "hear of" anything you want.  The bottom line is - you can do
authentication through the server, or through the application.  SSO
authentication requires server authentication.  Application (PHP)
authentication requires a form.

To be blunt: get an education in how authentication operates.  From your
questions, you are a definite danger to your client or employer.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#17134

FromArno Welzel <usenet@arnowelzel.de>
Date2016-10-08 12:33 +0200
Message-ID<f29d515a-66f0-c162-4051-dca84fc85e46@arnowelzel.de>
In reply to#17131
Tim Ritberg schrieb am 2016-10-08 um 00:50:

> Am 07.10.2016 um 23:13 schrieb Jerry Stuckle:
>> On 10/7/2016 12:07 PM, Tim Ritberg wrote:
>>> Am 07.10.2016 um 17:47 schrieb Arno Welzel:
>>>>
>>>> Then do it this way. If you need examples how to authenticate against an
>>>> AD server have a look at the DokuWiki authentication modules:
>>>>
>>>> <https://www.dokuwiki.org/auth:ldap>
>>>> <https://www.dokuwiki.org/auth:ldap_ad>
>>>> <https://github.com/splitbrain/dokuwiki/tree/master/lib/plugins/authad>
>>> This is not seamless.
>>>
>>>
>>> Tim
>>>
>>
>> Like it or not, that's your choice.  You can take it or you can leave it.
>>
> 
> What about other ways? I heard of SAML.

You can just try it: <https://simplesamlphp.org/>

But I'm not sure if this will solve your SSO problem.


-- 
Arno Welzel
https://arnowelzel.de
http://de-rec-fahrrad.de
http://fahrradzukunft.de

[toc] | [prev] | [next] | [standalone]

#17133

FromArno Welzel <usenet@arnowelzel.de>
Date2016-10-08 12:31 +0200
Message-ID<7e08c309-2d32-f7b9-a777-a845674d431d@arnowelzel.de>
In reply to#17128
Tim Ritberg schrieb am 2016-10-07 um 18:07:

> Am 07.10.2016 um 17:47 schrieb Arno Welzel:
>>
>> Then do it this way. If you need examples how to authenticate against an
>> AD server have a look at the DokuWiki authentication modules:
>>
>> <https://www.dokuwiki.org/auth:ldap>
>> <https://www.dokuwiki.org/auth:ldap_ad>
>> <https://github.com/splitbrain/dokuwiki/tree/master/lib/plugins/authad>
> This is not seamless.

Define "seamless" - without the need of entering username/password
again? Then use NTLM.

And no, there is no fallback. Live with it.




-- 
Arno Welzel
https://arnowelzel.de
http://de-rec-fahrrad.de
http://fahrradzukunft.de

[toc] | [prev] | [next] | [standalone]

#17135

FromTim Ritberg <tim@server.invalid>
Date2016-10-08 13:19 +0200
Message-ID<ntakna$gvg$1@tota-refugium.de>
In reply to#17133
Am 08.10.2016 um 12:31 schrieb Arno Welzel:
> 
> Define "seamless" - without the need of entering username/password
> again? Then use NTLM.
Thats right. I tried NTLM, but I can't use that with AD.

> 
> And no, there is no fallback. Live with it.
You can code NTLM with PHP. This is working but not compatible with AD
as user database.

Tim

[toc] | [prev] | [standalone]

Page 2 of 2 — ← Prev page 1 [2]

Back to top | Article view | comp.lang.php

csiph-web