Single sighn on for web app?

[Tegwin]

I have, what I believe to be a simple(ish) problem. With possibly a very complicated solution...

I have a web application that requires the user to log in. It authenticates against active directory to log the user on.

So the user logs into the workstation and then has to log in again onto the web page using the same username and password.


Is there any way of having it so that when the user logs in to the workstation it automatically picks up their A.D. Username and Password and completes a logon on the web application to initiate an authenticated session, so that when they click on the web icon, they are passed straight though into the application instead of having to stop at the password screen and re-enter their credentials?


I know its not the end of the world entering the details twice, but for some users who dont really want to use the program, this is becomming a boundary which I need to remove!

If anyone could suggest a solution, or reading materials that explain how the loggin details are handled when the user logs into windows, I would be greatful.

[localzuk]

What OS is the client, what browser, and what OS is the server and what http server software?

[Tegwin]

What OS is the client, what browser, and what OS is the server and what http server software?

Hi Localzuk.

Client- Windows XP SP3
Browser- IE7
The web application is running on a Unix server under Apache.
Active directory is on a Win 2K3 server.

I was hoping to be able to do it client side somehow perhaps using the "login.bat" file, as I have minimal access to the web application back end.

[dhicks]

Is there any way of having it so that when the user logs in to the workstation it automatically picks up their A.D. Username and Password and completes a logon on the web application to initiate an authenticated session

Try Googling around NTLM / Integrated Windows Authetication, that should get you started.

--
David Hicks

[SYNACK]

If it was running on ISS this would be trivial: IIS 6 Access control
you may be able to set it up the same way under linux but I don't know whether it supports that kind of authentication (NTLM).

[Wiseman82]

In IE Advanced Settings check that "Enable Integrated Windows Authentication" is enabled.
Add the site to the "Local Intranet" zone.

The above should do the trick. If not check that the security settings have "Automatic logon only in Intranet zone". (Custom Level button in Security tab)

[localzuk]

In IE Advanced Settings check that "Enable Integrated Windows Authentication" is enabled.
Add the site to the "Local Intranet" zone.

The above should do the trick. If not check that the security settings have "Automatic logon only in Intranet zone". (Custom Level button in Security tab)

This will only set one side of the process up, you also need your web server set up to use NTLM auth.

[Wiseman82]

This will only set one side of the process up, you also need your web server set up to use NTLM auth.

I'm not familiar with Apache but it does sound like the integrated authentication is enabled as users are prompted for their logon and are able to logon with their Windows credentials. The issue is to make this process automatic - I'm not aware of anything special you need to do in IIS, but Apache might be a different issue. I do know that you need to modify the browser settings to allow the automatic logon to work when using a Windows authentication app in IIS. I'd check the browser settings first then look if any server side options need to be enabled when using Apache.

[localzuk]

I'm not familiar with Apache but it does sound like the integrated authentication is enabled as users are prompted for their logon and are able to logon with their Windows credentials. The issue is to make this process automatic - I'm not aware of anything special you need to do in IIS, but Apache might be a different issue. I do know that you need to modify the browser settings to allow the automatic logon to work when using a Windows authentication app in IIS. I'd check the browser settings first then look if any server side options need to be enabled when using Apache.

Having login, and having NTLM login are 2 very different things in Apache, using very different mechanisms.