Single Signon for RT using Active Directory

25 10 2005

Over on Blah Blah Blog, Nathan has come up with what he describes as the “Holy Grail” of RT authentication in a Windows environment:

A lot of people use RT to track helpdesk requests, problem reports and other incident data at their jobs. An even larger number of people use or are forced to use Microsoft Active Directory as the central repository of username and password information at their jobs. As a result, probably the single most-asked question on the rt-users mailing list is “how do I unify logins between RT and ActiveDirectory?” Following close on behind that is “how do I get RT to use Windows authentication so people don’t have to type in their password twice?” Strangely, these are questions that seemed to lack any authoritative answers.
Until now.

Link to article on Blah Blah Blog

Advertisements

Actions

Information

34 responses

25 10 2005
Bryan

In any application, one would be better off using LDAP for authentication than some home-brew thing.

Microsoft wisely saw fit to make the AD an LDAP server as well, so if your app does the ‘DAP, you simply point it at the DC and have at it.

25 10 2005
Doctor Memory

Bryan–

The first cut of my article actually used the apache mod_authz_ldap module for authentication, and when I have some spare cycles I’m going to write up a section on how to do this without touching apache at all, but using only Net::LDAP from inside RT.

That said, there are a couple of advantages to using NTLM instead of LDAP.

First and foremost, it’s much more intuitive for users: they log in once to Windows itself, and then RT (or whatever the website is) “just works” when they browse to it, and they don’t have to re-authenticate. Considering that my helpdesk staff tends to field at least 2-3 requests a week from users who can’t seem to retain the idea that their Windows password can be used in other places, this is not insignificant.

Secondly… ADS speaks something that can charitably be called a dialect of LDAP, but it’s got some extremely strange quirks that can bite you on the ass in production. For instance, if a Windows user is a member of two or more LDAP groups, only the second or subsequent group will be returned as a “memberOf” attribute by an LDAP search. So if, for instance, you want to restrict access to members of the “Domain Users” group (cn=Domain Users, cn=Users, dc=site, dc=com), then every single one of those users had better also be a member or at least one other group, or your ldap search for “(&(sAMAccountName=foo)(memberOf=Domain Users))” will fail.

Also, LDAP queries are by default in cleartext, and at least in Server 2000, Microsoft’s TLS support is sorely lacking. NTLMv2 is a reasonably secure (and amply documented) challenge-response protocol. This also frees you from having to use SSL on the apache side to secure the password exchange between the user and the webserver, before ADS even gets involved.

Faced with issues like that, I don’t think it’s necessarily a bad idea to fall back to using NTLM and SMB: they’re in no sense deprecated in favor of LDAP by Microsoft, the view of ADS’ internal structure they present is somtimes a bit less obfuscated, and the experience for the user can be a less frustrating one.

25 10 2005
Doctor Memory

(sigh. the preview didn’t show my paragraph breaks, so I added <p> tags. so of course MT adds in paras for the actual post.)

2 10 2006
Kim Bjornstad

Wife full of cum

Single Signon for RT u…

3 10 2006
Melanie Ekkelkamp

Erotic sexual story wife

Single Signon for RT u…

3 10 2006
Kengo Nakamura

My daughter fucking

Single Signon for RT u…

3 10 2006
Nix Holger

Duaghter dad sex mother family group

Single Signon for RT u…

3 10 2006
Reinhard Andrian

Brazil teen ass

Single Signon for RT u…

3 10 2006
Martin Sokolski

Hairy ass gay

Single Signon for RT u…

3 10 2006
Maguus Lisbjerg

Core hard movie porn sex xxx

Single Signon for RT u…

3 10 2006
Dennis Rundberg

Claire forlani sex scene video clips

Single Signon for RT u…

3 10 2006
Kun Kuen Cheung

Butt fitting weld

Single Signon for RT u…

4 10 2006
Johnsan Hakam

Wife sex stories and photos

Single Signon for RT u…

4 10 2006
Dario Fredriksson

Spanking black woman

Single Signon for RT u…

4 10 2006
Joseph

1 free gay chat

Single Signon for RT u…

4 10 2006
Peter Huicberg

Paris hilton sex tape full

Single Signon for RT u…

4 10 2006
Ursala Schmidt

Ebony lesbian video clip

Single Signon for RT u…

4 10 2006
Sabine List

Vaginal anal sex

Single Signon for RT u…

4 10 2006
Lars Norberg

Black porn star angel

Single Signon for RT u…

4 10 2006
Kristina Mohr

Free cartoon porn movie clip

Single Signon for RT u…

5 10 2006
Jorgen Mikonder

Showing thong wife

Single Signon for RT u…

5 10 2006
Sohams Morgin

Pirates porn

Single Signon for RT u…

5 10 2006
Markus Carlsson

Jennifer lopez ass galleries

Single Signon for RT u…

5 10 2006
Thed List

Cum in mouth unload wife

Single Signon for RT u…

5 10 2006
Isabel Schacider

Hardcore butt fucking

Single Signon for RT u…

5 10 2006
Fatton Marie France

Black amateur picture

Single Signon for RT u…

5 10 2006
Bengt Ouov Lindguist

Ass vore

Single Signon for RT u…

5 10 2006
Kevin Schaufler

Couple hardcore movie

Single Signon for RT u…

5 10 2006
Mirika Rubensson

Amateur woman older mature

Single Signon for RT u…

7 10 2006
Lades Andelika

Jordan sex movie

Single Signon for RT u…

7 10 2006
Gil Coutinho

Tranny surprise movie

Single Signon for RT u…

7 10 2006
Andrea Ammara

Free movie porn trailer video

Single Signon for RT u…

7 10 2006
Brit Lord

Plan 69 from outer space

Single Signon for RT u…

7 10 2006
Skibicken Ramfred

Removable stripper pole

Single Signon for RT u…

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s




%d bloggers like this: