SSO in PHP application using AD credentials independent of Web Server

1
votes

I have a PHP application running with Nginx on a Linux server and it has a successful integration with my Active Directory using LDAP.

In the current scenario, the user is able to create a new login for the app or use his Windows credentials to log into the application.

Now, I'm trying to implement a complete Single-Sign On (SSO) and the user logged with his credentials in the Windows machine in the domain will be able to open the app logged without use the credentials again.

Doing some research on it, since my Linux server are not in the same domain, the best options is use NTLM (old and insecure), Kerberos protocol or Negotiate protocol (that will choose among NTLM and Kerberos for each request), depending on Windows version and what is implemented in the Domain Controller.

There is a lot of tutorials in the internet and also some good threads on the theme here in SO. This another link shows a good overview about the options using Apache as web server (for Kerberos option, I found a Nginx port, so this is not the main problem).

Well, I created some test application using these approaches (including all changes in the browser side, limited to Firefox), but all of then are dependents of Web Server (Apache, Nginx or even IIS). Since My app already has a complete integration with AD through LDAP, I'm interested in some Web Server independent solution. Are there any way to "bypass" the authentication in Web Server and get the information about the logged user direct on my PHP code (Client (Firefox) to Server (PHP))?

My best guesses for now are some type of "pure" PHP implementation of Kerberos, that needs of a PECL module or NTLM, that is insecure and still asks for the user credentials in the first request.

I know that maybe its impossible, but I'm asking it for the case that I missed something important information in this research. Is it possible to get the windows user info direct in PHP?

1
phpactive-directorykerberosntlmdomaincontroller
If you want to get the 'windows user' via SSO then SPNEGO protocol is the way to go. So you need some component which validates the Kerberos Service Token sent to your app via SPNEGO. It's quite interesting that there are not many PHP-extesions/modules available to achieve this. – Bernhard Thalmayr
I did a lot of research on the subject, but didn't found any PHP solution that is totally independent of WebServer – James
I dont believe this is theoretically possible, since php will always stand behind a web server. That is, php will only get information that the web server will pass onto it. Obviously, you cant get that information (which is found strictly on the client) in any way from php. The browser configuration is the first step, because he needs to pass the data, and the Web server needs to be configured to accept it. I'm basically looking for the same thing you do currently, with zero prior experience to AD, so this is just my opinion gathered from 3 hour research. – Milan Markovic
Also, the best solution for you is probably nginx.org/en/docs/http/ngx_http_auth_request_module.html – Milan Markovic

1 Answers

1
votes

If you don't insist on nginx use Apache Web Server 2.4 with mod_auth_gssapi this is great, high quality code written by people who know what they do. I have been doing this for years for my PHP stuff.