Je suis told that c'est possible to make a web application that does pas require a login. The user logs in to Windows, qui authenticates via an Active Directory (LDAP) Lookup. Then, they should be able to allez dans mon webapp et jamais see a login prompt. These customers have been referring to this as Single Sign On (perhaps incorrectly et part of mon confusion).
But, depuis what I read Single Sign On depuis le Tomcat docs is:
>
The Single Sign On Valve is utilized quand you wish to give users the
ability to sign on to **any one of le web applications associated with
votre virtual host**, et alors have leur identity recognized by all
autre web applications on le même virtual host.
Ceci est perfectly clear to me. User has to login once et can access chaque webapp on an instance of tomcat. But, what J'ai besoin de to do is somehow let them login sans ever providing tout credentials to mon tomcat server.
So, in order for this to work I imagine:
- User makes request for certains page
- Server sees no session token et alors request le client for certains credentials.
- The clients browser sans tout intervention depuis le user provides certains credentials to le server.
- Then, using those credentials provided by le clients browser it does a lookup in an LDAP.
J'ai seen certains examples qui use client side certificates... particularly le DoD PKI system qui makes certains sense to me parce que in those cases you [configure Tomcat to request client side certs](https://stackoverflow.com/questions/3929158/configuring-tomcat-to-accept-dod-cac-card-certificates), mais juste logging into windows Je ne see how this would work et what information le browser would pass to le server etc. Is this what NTLM is used for?
Comment fonctionne le SSO avec Active Directory pour une connexion transparente à une application web intranet ?
Re: Comment fonctionne le SSO avec Active Directory pour une connexion transparente à une application web intranet ?
First of tous - et in case autre users happen to visit this page - there are seulement certain authentication methods that allow you to do promptless SSO. These are **[NTLM](http://en.wikipedia.org/wiki/NT_LAN_Manager)** et **[Kerberos](http://en.wikipedia.org/wiki/Kerberos_%28protocol%29)**. LDAP - d'un autre côté - will jamais give you promptless SSO.
NTLM is actually NTLMv1 et NTLMv2. These are très différent et NTLMv1 is deprecated parce que of serious security issues. Vous devriez shy away depuis Java authentication solutions that fail to correctly identify si they support NTLMv1 ou NTLMv2 parce que they seulement use le word "NTLM" in leur documentation. Chances are le developer's of said security solution ne know themselves qui is tous le more reason to cherchez le fire escape.
Contrary to traditional belief les deux NTLMv1 et NTLMv2 are fully documented by Microsoft mais you will encore find solutions that claim to have 'reverse engineered' le protocol. C'est true that this was needed prior to Microsoft documenting le protocols Je crois around 2006 ou 2007. Anyway NTLMv1 is a no-no. Il y a nothing wrong avec NTLMv2 per-se mais Microsoft has been phasing out NTLM (in tout form) in tous of its products in favour of Kerberos authentication. NTLMv1 is long dead et NTLMv2 is now seulement used by Microsoft in cases où no Domain Controller is available. Bottom line: NTLM (in tout form) is pas really le way forward. We should actually salute Microsoft for taking a standards based approach here.
This leaves you avec Kerberos. Microsoft has created a protocol for negotiating et transporting authentication information over HTTP. Ceci est known in Microsoft products as "[Integrated Windows Authentication](http://en.wikipedia.org/wiki/Integrated_Windows_Authentication)" mais it has been nailed down as an official standard under le name of **[SPNEGO](http://en.wikipedia.org/wiki/SPNEGO)**. Ceci est what you should be looking for. SPNEGO supports les deux NTLMv2 et Kerberos as le underlying authentication mechanism mais for le ci-dessus reasons you should be targeting Kerberos plutôt than NTLMv2.
J'ai successfully integrated plusieurs Tomcat applications (running on Linux/Solaris) avec Active Directory using le [SPNEGO Project at SourceForge](http://spnego.sourceforge.net/). J'ai found this to be le simplest approach. This gives you promptless SSO similaire to what par exemple a Sharepoint server does. Ceci est le plus likely what votre users will expect quand talking about 'SSO'. Getting le Kerberos configuration right, generating keys et setting up 'dummy' accounts in Active Directory can be a hassle mais once you get it right it works like a charm.
The seulement thing I do pas like about le [SPNEGO Project at SourceForge](http://spnego.sourceforge.net/) is that I do pas understand how often it performs le authentication. My nasty suspicion is that it does it for chaque page view plutôt than once for chaque session. Perhaps Je suis wrong in this. Anyway: this highlights another thing to consider in SSO solutions: you ne want to implement a solution that 'spams' votre identity provider (say Active Directory) avec unnecessary requests.
NTLM is actually NTLMv1 et NTLMv2. These are très différent et NTLMv1 is deprecated parce que of serious security issues. Vous devriez shy away depuis Java authentication solutions that fail to correctly identify si they support NTLMv1 ou NTLMv2 parce que they seulement use le word "NTLM" in leur documentation. Chances are le developer's of said security solution ne know themselves qui is tous le more reason to cherchez le fire escape.
Contrary to traditional belief les deux NTLMv1 et NTLMv2 are fully documented by Microsoft mais you will encore find solutions that claim to have 'reverse engineered' le protocol. C'est true that this was needed prior to Microsoft documenting le protocols Je crois around 2006 ou 2007. Anyway NTLMv1 is a no-no. Il y a nothing wrong avec NTLMv2 per-se mais Microsoft has been phasing out NTLM (in tout form) in tous of its products in favour of Kerberos authentication. NTLMv1 is long dead et NTLMv2 is now seulement used by Microsoft in cases où no Domain Controller is available. Bottom line: NTLM (in tout form) is pas really le way forward. We should actually salute Microsoft for taking a standards based approach here.
This leaves you avec Kerberos. Microsoft has created a protocol for negotiating et transporting authentication information over HTTP. Ceci est known in Microsoft products as "[Integrated Windows Authentication](http://en.wikipedia.org/wiki/Integrated_Windows_Authentication)" mais it has been nailed down as an official standard under le name of **[SPNEGO](http://en.wikipedia.org/wiki/SPNEGO)**. Ceci est what you should be looking for. SPNEGO supports les deux NTLMv2 et Kerberos as le underlying authentication mechanism mais for le ci-dessus reasons you should be targeting Kerberos plutôt than NTLMv2.
J'ai successfully integrated plusieurs Tomcat applications (running on Linux/Solaris) avec Active Directory using le [SPNEGO Project at SourceForge](http://spnego.sourceforge.net/). J'ai found this to be le simplest approach. This gives you promptless SSO similaire to what par exemple a Sharepoint server does. Ceci est le plus likely what votre users will expect quand talking about 'SSO'. Getting le Kerberos configuration right, generating keys et setting up 'dummy' accounts in Active Directory can be a hassle mais once you get it right it works like a charm.
The seulement thing I do pas like about le [SPNEGO Project at SourceForge](http://spnego.sourceforge.net/) is that I do pas understand how often it performs le authentication. My nasty suspicion is that it does it for chaque page view plutôt than once for chaque session. Perhaps Je suis wrong in this. Anyway: this highlights another thing to consider in SSO solutions: you ne want to implement a solution that 'spams' votre identity provider (say Active Directory) avec unnecessary requests.