# Active Directory / IE Auto Authentication

**URL:** <https://www.ruby-forum.com/t/active-directory-ie-auto-authentication/123578>\
**Category:** Rails\
**Created:** [December 18, 2007, 10:15pm UTC](https://www.ruby-forum.com/t/active-directory-ie-auto-authentication/123578 "2007-12-18T22:15:52Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [December 18, 2007, 10:15pm UTC](https://www.ruby-forum.com/t/active-directory-ie-auto-authentication/123578/1 "2007-12-18T22:15:52Z")

</div>

Has anyone been able to get some sort of Active Directory auto login  
functionality working in a rails app? Doesn’t IE make available some  
kind of ldap token that I could grab?

Thanks,  
Kevin

---

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [December 18, 2007, 10:42pm UTC](https://www.ruby-forum.com/t/active-directory-ie-auto-authentication/123578/2 "2007-12-18T22:42:11Z")

</div>

You’re thinking about Kerberos.

If you’re using Apache as a web server then you can use something like  
[http://modauthkerb.sourceforge.net/](http://modauthkerb.sourceforge.net/) to authenticate the user and pass  
the username through to as a variable.

On Dec 19, 8:14 am, “removed\_email\_address@domain.invalid” [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)

---

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [December 18, 2007, 10:55pm UTC](https://www.ruby-forum.com/t/active-directory-ie-auto-authentication/123578/3 "2007-12-18T22:55:06Z")

</div>

I don’t want apache handling authentication for me, my rails app is  
handling authentication. What I want is if the user is logged into  
the domain and using IE, be able to grab their active directory  
username. And if they aren’t using IE, my rails app will present them  
with a login form.

Thanks,  
Kevin

On Dec 18, 1:41 pm, “removed\_email\_address@domain.invalid”

---

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [December 19, 2007, 12:46am UTC](https://www.ruby-forum.com/t/active-directory-ie-auto-authentication/123578/4 "2007-12-19T00:46:15Z")

</div>

Yes. What you’re talking about is Integrated Windows Authentication  
(i.e. SPNEGO). This is basically Internet Explorer passing Kerberos or  
NTLM tokens if the web server supports it or falling back to HTTP  
Basic auth otherwise.

This means that either your rails app needs to be able to talk SPNEGO  
itself (which would be complicated to implement) or you have to rely  
on the web server for authentication. Once the web server has done the  
authentication you can read the username in your rails app through a  
HTTP environment variable.

I know thats not precisely what you want, but that is what is  
available.

Matthew

On Dec 19, 8:54 am, “removed\_email\_address@domain.invalid” [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)