3 users Sign-in to change your status

AD authentification and SSO plugin. Security

• Repository
• Download package
• Browse source

The vjAuthPlugin packages authentification using Active Directory and Single Sign On (SSO) with NTLM protocol if activated.

Developers

Name	Status	Email
Jean-Philippe MORVAN	lead	rf.fiujelliv-elliv <<ta>> navrom.pj

License

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is furnished
to do so, subject to the following conditions:

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
THE SOFTWARE.

Releases for sf 1.4

Releases for sf 1.3

Releases for sf 1.2

Join this plugin team

Other releases

Release 2.1.1 - 29/12/2009

Release 2.1.0 - 29/12/2009

Release 2.0.0 - 27/11/2009

Release 1.2.1 - 29/12/2009

Release 1.2.0 - 29/12/2009

Release 1.1.0 - 27/11/2009

Release 1.0.3 - 14/09/2009

Release 1.0.2 - 14/09/2009

Release 1.0.1 - 14/09/2009

Release 1.0.0 - 10/09/2009

Release 0.9.3 - 23/07/2009

Release 0.9.2 - 20/07/2009

Release 0.9.1 - 20/07/2009

Release 0.9.0 - 17/07/2009

vjAuthPlugin

The vjAuthPlugin packages authentification using Active Directory and Single Sign On (SSO) with NTLM protocol if activated.

Installation

• Install the plugin

  $ symfony plugin:install vjAuthPlugin
  

• Create the link to vjAuthPlugin's css files

  $ symfony plugin:publish-assets
  

• Clear the cache

  $ symfony cache:clear
  

Secure your application

To secure a symfony application:

• Enable the module vjAuthPlugin in settings.yml

   all:
     .settings:
       enabled_modules: [..., vjAuthLogin]
  

• Change the default login modules in settings.yml

    login_module:           vjAuthLogin
    login_action:           login
  

• SF 1.3/1.4 : Secure some modules or your entire application in security.yml

    default:
      is_secure: true
  

• Add some parameters in app.yml

    all:          
      ad:
        options:   # theses options are usefull for the adldap class, the documentation is online
          account_suffix:            '@mysite.fr'
          base_dn:                   'DC=mysite,DC=fr'
          domain_controllers:        [ "myDC1.mysite.fr", "myDC2.mysite.fr" ]
          ad_username:               'username_administrator_active_directory'
          ad_password:               'password_administrator_active_directory'
          recursive_groups:          false
        group_prefix:                PREFIX_
        group_authorize:             GROUP     # the real name of the group authorize to use the application is : PREFIX_GROUP
        ntlm_active:                 true      # if ntlm activated, autologon with the windows username (there are some issues with the NTLM protocol, they are documente farther in this readme)
  

NTLM Issues

The NTLM protocol talk some issues. It uses to make some modifications on each computer (for each user more precisely).

• For Microsoft Internet Explorer, you need to modify 3 keys on the windows registry (ie for the Intranet domain : www.yourDomain.com)

    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
    "DisableNTLMPreAuth"=dword:00000001
    "EnableNegotiate"=dword:00000000
    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\yourDomain.com]
    "*"=dword:00000001
  

• For Mozilla Firefox, you need to modify the configuration of the browser (type about:config on the url)

    search ntlm
    network.automatic-ntlm-auth.allow-proxies   true
    network.automatic-ntlm-auth.trusted-uris    yourDomain.com
    network.ntlm.send-lm-response               true
  

Theses fixs work on IE6, IE7, IE8 and FF3.5 but I think they work too on FF2 and FF3.

TODO

• write more documentation

• any idea, advice, other ? please email me :)