Back on May 23rd, 2007 I wrote an article titled Single Sign-On with Apache and Active Directory which I have now made Part 1 of this topic. In that article I wrote:

There are 3 major solutions for this which are mod_ntlm, mod_auth_kerb and Apache2:AuthenNTLM…I tried mod_ntlm which seemed to be very easy to setup and worked well. But there was one catch…If the browser did not send the NTLM information or correct NTLM information, see the footnotes¹ below as to why, the user had to login with the username in the form of DOMAIN\username. In my experience with applications already in place they did not require this form of DOMAIN\username. This could be resolved if you could specify the default domain in mod_ntlm which you cannot.

Now I will explain why there is a Part 2 to this topic. I used the Apache2::AuthenNTLM Apache Perl module in a large environment and quickly found a serious problem which I could not diagnose or resolve. When using the Apache2::AuthenNTLM Perl module Apache would stop responding to requests to the site after an undetermined number of requests. I tried limiting the file types that would be authenticated but in the end it would still stop reaponding after a while.

So I finally decided to use the Apache mod_ntlm module to handle the authentication. And with the article I had written titled Enabling NTLM Authentication (Single Sign-On) in Firefox , the problem with having to use the username in the form of DOMAIN\username in Firefox can be eliminated.

This how to is intended for CentOS 4 and RHEL4 but can be easily adapted for other distributions.

Now for the HowTo:

1) Start by installing Apache by issuing the following command:
yum install httpd

2) Next we need to install the mod_ntlm Apache module

wget http
:
//sivel.net/repo/i386/mod_ntlm-2-0.1.el4.sn.i386.rpm

rpm 
-
ivh mod_ntlm
-
2
-
0.1
.
el4
.
sn
.
i386
.
rpm

3) Now we need to configure mod_ntlm

cd 
/
etc
/
httpd
/
conf
.
d
vi mod_ntlm
.
conf

Modify the conf like so (the documentation in the conf pretty much covers it also):

<location
 ~ 
"/path/to/dir/to/protect/here)/(.*)"
 
>


? # NTLMAuth - set to 'on' to activate NTLM authentication here
? NTLMAuth on

? # AuthNTGroups - text file containing (NT) group names and member user IDs

? # NTLMBasicAuth - set to 'on' to allov Basic authentication too

? # NTLMBasicRealm - realm to use for Basic authentication

? # NTLMAuthoritative - set to 'off' to allow access control to be passed along to lower modules if the UserID is not known to this module
? NTLMAuthoritative on

? # NTLMDomain - set to the domain you want users authenticated against for cleartext authentication - if not specified, the local machine, then all trusted domains are checked
? NTLMDomain MYDOMAIN

? #