Iis – Single Sign-on for Intranet WordPress using OpenID (or OAuth), IIS, Integrated Windows Authentication, Active Directory

active-directoryiisntlmopenidWordpress

Is it possible to have single sign-on for intranet WordPress sites by using OpenID (or OAuth), IIS, Integrated Windows Authentication, Active Directory?

I'd like to have Active Directory users automatically log in to non-IIS (LAMP) intranet sites like WordPress. We have intranet sites where users log in automatically using integrated NTLM. Could we host an OpenID provider on an IIS site where users log in automatically using their domain credentials?

Best Answer

I would try the WordPress Active Directory Plug In.

I'm getting ready to use this on a project, and I think that it looks promising.

Related Solutions

Single Sign On for intranet with Apache and Linux MIT Kerberos

I found it!

I followed the instructions on https://help.ubuntu.com/community/SingleSignOn (See: "Application Installation") to configure the Apache webserver.

Here is my httpd.conf [IMAGE]:

ServerName www.eindwerk.lan

< Directory /var/www/ > Options Indexes FollowSymLinks MultiViews
   AllowOverride None
   Order allow,deny
   allow from all

  AuthType Kerberos
KrbMethodNegotiate on

KrbMethodK5Passwd on
  AuthName "Kerberos Login"
  KrbAuthRealm EINDWERK.LAN
  Krb5Keytab /etc/apache2/auth/apache2.keytab
  require valid-user
< /Directory >

Then, I configured Mozilla Firefox to trust my internal site (www.eindwerk.lan) [IMAGE]:

network.negotiate-auth.delegation-uris : eindwerk.lan

network.negotiate-auth.trusted-uris: eindwerk.lan
Do a kinit in a terminal. [IMAGE]
Browse to the internal site: You are now automatically logged in!

How does this work?
- Mozilla Firefox does a regular HTTP/GET request.
- Apache replies with HTTP/401 Authorization Required.
- Mozilla Firefox replies with the Kerberos token we just got with kinit. [IMAGE OF WIRESHARK CAPTURE]
- Kerberos authentication occurs, and Apache replies with HTTP/200 OK.
Do a klist in a terminal. You should see the ticket for the webserver! [IMAGE]
Do a kdestroy in a terminal. [IMAGE]
Hard refresh (CTRL+F5) the internal site. You are now presented with a login prompt! [IMAGE]

Windows – ASP.NET Integrated Windows Authentication fails inside network using domain name

By default, integrated windows authentication is only used for the "local intranet" zone in Internet Explorer. Thus, if www.school.com isn't recognized by IE as being a part of the local intranet, integrated authentication won't work.

Best Answer

Related Solutions

Single Sign On for intranet with Apache and Linux MIT Kerberos

Windows – ASP.NET Integrated Windows Authentication fails inside network using domain name

Related Topic