|
Friday, 18 August 2006 11:24 |
|
This is a quick-and-dirty method for kludging NTLM authentication (aka ActiveDirectory) into Apache 2, for purposes of doing HTTP authentication. Assuming you can get it running after following the steps below, you should be able to configure access files under Apache that will direct the webserver to authenticate HTTP users against a domain of your choosing. The server does not have to be joined to the domain.
- Checkout latest mod_ntlm module from the SourceForge CVS repository:
cvs -d:pserver:anonymous@cvs.sf.net:/cvsroot/m<wbr>odntlm checkout mod_ntlm - Change to the mod_ntlm directory created by the checkout process
- Edit configure.in so that the "/usr/include/apache2" directory points to where you have your Apache 2.0 header files located.
HINT: You'll either need to have the Apache 2.0 source installed, or have an httpd-devel-* RPM of some sort installed. - Also modify configure.in so that the path for apxs is correct. The default of "/usr/sbin/apxs2" is probably not correct, but Your Mileage May Vary.
- Run autogen.sh and cross your fingers (If first run of autogen.sh fails with a syntax error on line 33, remove trailing backslash from the "for" loop on the line above. Re-run the autogen.sh script)
- Assuming the autogen.sh script has succesfully run all the way, you should have a bunch of new files in your mod_ntlm directory, including a current Makefile
- Run make and watch some warning messages float by
- Look in the .libs directory and see if you now have mod_ntlm.so
- Copy the mod_ntlm.so from the .libs directory into the main mod_ntlm directory
- Do a make install
- If make install fails, manually install module
- copy mod_ntlm.so to your Apache 2.0 modules directory (/usr/include/httpd/modules)
- chmod 755 mod_ntlm.so (in it's new location)
- Edit Apache 2.0 configure file to include a loadmodules line for this new module: LoadModule ntlm_module modules/mod_ntlm.so
- Restart apache (apachectl reload)
And that about does it. Of course NTLM authentication isn't secure, but you can try doing it over HTTPS. Except it won't work with Internet Explorer under HTTPS. But it does with Firefox. Why am I not surprised?
Only real disappointment is the lack of ability to do NTLM group authentication. Oh well... |