Search the Community

Hello everyone, We have just got the booking system up and running and working quite well. I was just wondering if the following authentication scenario is supported: If so, is it possible for it to be set up like this: https://hap.school.lea.sch.uk/hap/bookingsystem - this uses Windows Authentication and logs the user in automatically https://hap.school.lea.sch.uk/hap/helpdesk - this uses Windows Authentication and logs the user in automatically but if they were to go to: https://hap.school.lea.sch.uk/hap - it would show the login form and ask for username and password. Thanks.

Many, many hours of work has paid off in a CentOS 5 machine with apache 2.2 serving up secured folders that require logged-in Active Directory users to access. This is for a corporate intranet, which I am VERY much looking forward to getting off of Windows 2003 Server! I've run into a wall, however, one which appears pretty rare, if my Google searches are any indication. The secured folder (/pvt) is very puzzling to apache. For instance, it doesn't serve up a default index page, giving a 404 error when the folder is accessed directly (http://arweb5/pvt). The access log shows the AD user's id, as it should. If I specify a (html) web page, it renders as raw html in Firefox. It renders okay in IE7, due (I know) to IE's mangling of www code standards. If I specify a php web page in either browser, I get the raw php code. These behaviors are all absent if I turn ntlm_auth off on the folder. The default index page suddenly gets served up, the php is translated at the server level, providing a nice finished product in the browser (Firefox or IE). Here's the appropriate httpd.conf code: AuthName "NTLM Authentication thingy" NTLMAuth on NTLMBasicAuthoritative on NTLMAuthHelper "/usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp" NTLMBasicRealm MFC require valid-user RewriteEngine On Any help much appreciated!

We have started to deploy Windows 7 using Microsoft Deployment Toolkit (MDT) and Deployment Services (we have always used Ghost in the past). Unfortunately we have found (after deploying 60 machines!) that the Internet does not work on a MDT deployed workstation on Internet Explorer 8 or 9 (DVD installed and Ghosted workstations work fine?!). We are however able to connect to the Internet using Firefox and Chrome, download Windows updates and device drives from the Internet, ping the county councils proxy and connect to the Netsweeper admin console from the affected machines using IE. Internet proxy settings are set by Group Policy and work fine for XP and Windows 7 workstations that we have installed from DVD or imaged using Ghost. We have tried deploying a workstation to a workgroup rather the domain (thus no GPOs applied) and after manually entering the proxy information IE still doesn’t work (but Firefox etc. do..) Microsoft are now involved and although we still have no resolution we have discovered using Microsoft Network Monitor 3.4 that it appears to be an issue related to NTLM authentication as when the proxy asks the second time for NTLM authentication the workstation fails to send another request and simply displays the ‘Internet Explorer cannot display the webpage’ page. It appears that IE only sends the domain and workstation name to the proxy and then fails to respond when requested for the username. On a working workstation IE will send an additional request with domain, workstation name and username and from there the proxy will authenticate and send the page requested. The question is, has anyone else experienced this issue, either related to MDT or separately? If the answer is yes have you managed to resolve it and what was the resolution? Any help with this is much appreciated as our Windows 7 deployment is now very much at risk. Many thanks Nath

I’m kinda stuck with something and it’s really bugging the hell out of me and I was wondering if anyone else has seen the same thing? Basically Firefox is still requesting a username and password to the local intranet site even though the following parameters have been set in "about:config": pref("network.automatic-ntlm-auth.trusted-uris", "domain.net"); pref("network.negotiate-auth.delegation-uris", "domain.net"); pref("network.negotiate-auth.trusted-uris", "domain.net"); The pop-up box states the following: Authentication Required A user name and password are being requested by http://www.domain.net. The site says: "Digest" However, when the box is cancelled it then goes on to automatically load the user's credentials correctly using NTLM. It's quite annoying and I want to stop it but I can't seem to find a way how to. It looks like it's trying to authenticate using Digest before accepting the NTLM credentials. Would that be a fair assumption? If so, how do I prevent it? I can't find a setting in Firefox which will change the order of preference or indeed makes any reference to Digest. Is there a setting which needs to be changed in IIS? Any ideas?

Hello everyone, This question has probably been asked before, but here goes: We have setup a Moodle server that can be accessed by going to the following address: http://moodle and NTLM authentication works correctly. However, when we change it to use an FQDN: http://moodle.school.lea.sch.uk and then access Moodle internally via that address the NTLM authentication does not work. (Our domain is a .local domain) Any advice/suggestions would be welcomed. Thanks in advance. J.Worth

Hi Guys, I've been trying to set up SSO using Apache on the debian server, the users are authenticate using LDAP (which works), I've built and configured the auth_ntlm_winbind_module, and configured winbind. Our moodle version is Moodle 1.9.4+ (Build: 20090422). wbinfo -u returns a list of all the users, so that works fine. I've set up a test file (ntlmTest.php) which does echo ""; var_dump($_SERVER); echo ""; and the REMOTE_USER is being set by the NTLM as: OURDOMAIN\itrob so that part works, in the sites-enabled default file I've added NTLMAuth on AuthType NTLM AuthName "Moodle NTLM Authentication" NTLMAuthHelper "/usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp" NTLMBasicAuthoritative on require valid-user NTLMAuth on AuthType NTLM AuthName "Moodle NTLM Authentication" NTLMAuthHelper "/usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp" NTLMBasicAuthoritative on require valid-user and there are no errors in the /var/log/apache2/error.log file so this appears to be working ok ( plus that test file works, so again it's fine!) However! when I go to http://moodle it still presents me with a login page, I've added http://moodle to the trusted sites so IE should still send the NTLM information but I'm at a loss as to why it's just not working now! Bit more info: NTLM SSO is enabled, the subnet is 10.133.0.0/16 and IE fast path is off. Does anyone have ANY idea as to why it's not doing the SSO, I think I'm going insane here! Thanks -Rob

Hi, Ive joined my proxy to the domain (its running ubuntu 7.10 server) and i think ive configured squid to authenticate with the domain using NTLM. I can run wbinfo -u and it lists the users on the domain so i can tell its joined correctly. Heres the auth_ntlm part of the squid file ##ADDED BY JACK auth_param ntlm program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp auth_param ntlm children 10 #auth_param ntlm max_challenge_reuses 0 #auth_param ntlm max_challenge_lifetime 2 minutes #auth_param ntlm use_ntlm_negotiate off auth_param basic program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-basic auth_param basic children 5 auth_param basic realm Domain Proxy Server auth_param basic credentialsttl 2 hours auth_param basic casesensitive off authenticate_cache_garbage_interval 10 seconds # Credentials past their TTL are removed from memory authenticate_ttl 0 seconds And for my ACL ive got acl passwd proxy_auth REQUIRED http_access allow passwdIt doesnt seem to be putting the users name in the access.log file, how can i check that its authenticating properly. Heres my full squid.conf