Admin: 2 revisions imported

2016-04-06T20:15:46Z

2 revisions imported

New page

The following document will allow you to setup authentication against a windows domain using mod_perl and [[AuthenHTLM]]

Follow the steps given below for getting NTLM authentication working.

1. Install/Configure mod_perl under Apache - (and get it working of-course)
2. Download the following files for doing NTLM authentication (the following files worked for us)
* For Fedora Core systems download the module from
http://search.cpan.org/~speeves/Apache2-AuthenNTLM-0.02/AuthenNTLM.pm
* For Debian Linux systems, download the module from
http://search.cpan.org/~speeves/Apache-AuthenNTLM-2.10

3. Install the module

tar xvfz Apache*AuthenNTLM*.tgz
cd Apache*AuthenNTLM*
perl Makefile.PL
make
make test
make install

4. Edit the Apache configuration and enable KeepAlive

KeepAlive On

Restart your Apache server.

5. Configure apache to do the authentication. For example in .htaccess add

# Enable the Authentication module
PerlAuthenHandler Apache2::AuthenNTLM

# domain pdc bdc
# Domain : Your windows domain
# pdc : Primary Domain Controller
# bdc : Backup Domain controller.
#
# Note : Multiple domains can be specified.

PerlAddVar ntdomain "OURDOMAIN domainpdc domainsdc"

# What should be the default domain
PerlSetVar defaultdomain OURDOMAIN

# The user names are in the form "OURDOMAIN\user_name". Let us split it.
PerlSetVar splitdomainprefix 1

# Set the debug variables
PerlSetVar ntlmdebug 0
PerlSetVar ntlmauthoritative off

More documentation is available in the accompanying README file in the tarball or the following link

Once this is done, the domain user is populated as REMOTE_USER in the http server variables,
which can be picked up by any application for doing authentication.

6. Configure RT for external web authentication. In RT_SiteConfig.pm:

Set($WebExternalAuth , '1');
Set($WebFallbackToInternalAuth , '1');
Set($WebExternalGecos , undef);
Set($WebExternalAuto , '1');

7. # Configure the apache virtual host to use mod_ntlm for authentication:

<VirtualHost *>
ServerName rt.example.com
DocumentRoot /opt/rt3
AddHandler fastcgi-script fcgi
Alias /NoAuth/Images/ /opt/rt3/share/html/NoAuth/images/
ScriptAlias / /opt/rt3/bin/mason_handler.fcgi/
<Directory "/opt/rt3">
AddDefaultCharset UTF-8
SetHandler fastcgi-script
AuthName "Request Tracker"
AuthType ntlm,basic
require valid-user
</Directory>

<Location /REST/1.0/NoAuth>
satisfy any
allow from all
</Location>
<Location /NoAuth>
satisfy any
allow from all
</Location>
<Location /NoAuth/images>
SetHandler default-handler
</Location>

</VirtualHost>

8. Restart Apache

9. Add the URL of your RT apache vhost to either the "trusted sites" or "intranet sites" zone of Internet Explorer.

You can do this on a site-wide basis via the Group Policy Object for your domain controller:

1. Run "MMC" from Start->Run
2. From the "Console" menu, select "Add/Remove Snap-in"
3. From the "Add/Remove Snap-in" dialog, hit the "Add" button.
4. Select "Group Policy" and hit "Add". This will bring up the "Select Group Policy" wizard.
5. Hit the "Browse..." button, then select the Default Domain Policy for your domain and hit OK.
6. Hit the "Finish" button in the Select Group Policy wizard, then the "Close" button on the "Add
Standalone Snap-in" dialog, then the "OK" button of the "Add/Remove Snap-in" dialog.
7. From the Default Domain Policy root, browse down to: User Configuration -> Windows Settings ->
Internet Explorer Maintenence -> Security, and double-click on the "Security Zones and Content
Ratings" object.
8. From the "Security Zones and Content Settings" tab, select the "Import the current security
zones and privacy settings" radio button and click the "Modify Settings" button.
9. This will bring up the GPO version of the "Internet Properties" control panel. Select either
the "Local Intranet" or "Trusted Sites" zone as appropriate for your organization and hit the
"Sites" button in order to add your RT vhost to that zone. If your RT vhost is not SSL-secured,
you will need to un-check the "Require server verification" checkbox before adding the site.
adding a domain to trusted sites
10. Hit "OK" to close the "Internet Properties" panel, and then "OK" to close the "Security Zones and
Content Ratings" panel. You can then close the entire MMC console.
11. Your end-users may need to reboot for the Group Policy to be applied to them.

If you add [[AutoCreateFromExternalUserInfo]] to this you will be able to allow users to create and modify and view tickets from the website.

Special thanks to http://blank.org/memory/output/rt-ad-sso.html and drupal.org/node/44718

Sites from which I pieced together the information to get this document

NTLM - Revision history

Admin: 2 revisions imported