且构网

分享程序员开发的那些事...
且构网 - 分享程序员编程开发的那些事

如何单点登录(SSO)与PHP + Apache的工作,对用于透明身份验证的Active Directory?

更新时间:2023-12-04 23:08:22

认证是一个混乱的烂摊子。下面是一些背景。

Authentication is a confusing mess. Here is some background.

  • LDAP:LDAP是一种协议,通信用户的目录信息。它也可以处理认证,但它不是无缝(SSO)的

  • LDAP: LDAP is a protocol for communicating user directory information. It can also handle authentication, but it is not seamless (SSO).

NTLM:NTLM是内置IE浏览器,的ActiveDirectory和IIS微软的SSO。 NTLM的原始版本是非常不安全的,以便NTLMv2的实施,以修复NTLM安全问题。原来NTLM在Windows Vista中默认情况​​下禁用及更高版本。

NTLM: NTLM is Microsoft's SSO built into IE, ActiveDirectory and IIS. The original version of NTLM is very insecure so NTLMv2 was implemented to fix the security issues in NTLM. The original NTLM is disabled by default in Windows Vista and later.

的Kerberos:Kerberos是一个开放的标准,这是非常安全的,旨在提供无缝(SSO)认证。 ActiveDirectory的支持Kerberos版本。

Kerberos: Kerberos is an open standard that is very secure and is designed to offer seamless (SSO) Authentication. ActiveDirectory supports a version of Kerberos.

至于可用于实现这些协议的Apache模块,则包含其中的一个pretty的良好列表

As far as the Apache modules that can be used to implement these protocols, you included a pretty good list of them.

  • mod_ntlm:这是一个运行在Linux,并支持原NTLM(不NTLMv2身份)Apache模块

  • mod_ntlm: This is an Apache module that runs on Linux and supports the original NTLM (not NTLMv2).

mod_auth_kerb所:这是一个实现Kerberos的Apache模块

mod_auth_kerb: This is an Apache module that implements Kerberos.

mod_auth_sspi:这是Windows支持原来的NTLM(不NTLMv2身份)Apache模块

mod_auth_sspi: This is an Apache module for Windows that supports the original NTLM (not NTLMv2).

的Apache2:AuthenNTLM:这是处理NTLM的Perl模块。我不知道它是否支持NTLM和NTLMv2。

Apache2:AuthenNTLM: This is a Perl module that handles NTLM. I don't know if it supports NTLM and NTLMv2.

mod_auth_ntlm_winbind:这是一个与Samba的认证接口的Apache模块。

mod_auth_ntlm_winbind: This is an Apache module that interfaces with Samba's authentication.