currently we run web applications on nginx accessible from MS clients
part of a Windows Domain.
the users are requested to authenticate via Basic-Auth (via HTTPS)
which nginx validate against the
domain activ directory using GitHub - kvspb/nginx-auth-ldap: LDAP authentication module for nginx
But I think the MS browser could do NTLM auth as well.
Just a side note: NTLM auth is broken by design and violates HTTP
basic rules. Avoid using it if you can.
to be clear: I don’t care if it’s named NTLM or ugly_voodoo
The goal is a nginx accesses by a IE/edge browser. Users should not be
bothered with authentication
as they are already logged on into the windows account.
Im not sure what you do not understand from the reply, NTLM auth is
broken. This is not about “lets call it Voodoo_melt” and make it work,
Windows utilizes NTLM, so… what you are trying to use will not work.
why? because NGINX NTLM does not work.
Now, if you are looking for a solution… a solution you may have.
re-route your authentication to squid which does support NTLM auth . If
this is not what you want to do then you are more than welcome to write
a NTLM auth module that works.
On Mon, Apr 18, 2016 at 02:28:19PM -0700, Payam C. wrote:
possible?
Im not sure what you do not understand from the reply, NTLM auth is broken.
This is not about “lets call it Voodoo_melt” and make it work, Windows
utilizes NTLM, so… what you are trying to use will not work. why? because
NGINX NTLM does not work.
No, you didn’t get it. NTLM http auth itself, as “defined” by
RFC 4559, is broken by design, and it has nothing to do with nginx.
In anything more complex than “a server and directly connected
clients” it’s expected to require various NTLM-specific hacks,
quirks, and so on. Because NTLM tries to authenticate connections
instead of requests, thus breaking basic HTTP principles.
Depending on the versions of Windows and what you are trying to do, it
may be possible to use Kerberos via Nginx, rather than NTLM. It
requires some foo setting up Service Principal Names, but does work
properly via an HTTP proxy, and provides passthrough auth, which seems
to be what the desire here is.
Kerberos and NTLM are two completely different ways of authenticating
a user. Whilst they essentially do the same thing, the main difference
that you care about is that Kerberos works correctly over HTTP, unlike
NTLM which does not.
what role play the proxy mentioned here not the first time?
I am using the term generically. Nginx is a proxy to whatever
application you are running behind it - in the sense that you make a
request to Nginx from a client, and Nginx sends it (proxies) it to
your application server - be that a WSGI application or whatever.
That part I don’t know - but it also really does not matter as your
problem seems to be pass-through authentication on Nginx?