[xwiki-users] SSO via NTLM

[Schmidt, Thilo (VZ)]

Hello,
I'm trying to get some kind of NTLM authentication going on my Debian server, but got lost very early.
I find mentions of working NTLM solutions in the archives as well as some fixes for an ominous "NTLM authenticator" (XCONTRIB-84) in Jira.
I even found some installation-guide in the sandbox, but there seems to be no jar file.

Is there some kind of working NTLM solution without installing kerberos or samba?

Thanks in advance,
Thilo

[Guillaume Fenollar]

Hi Thilo,

I worked a lot on this subject these two last days. But I only experimented
Kerberos, and Samba/Winbind/NTLM.
Why don't you want to install Samba? It's easier to make it work than a
Kerberos system (from what I saw). You have to install Samba, configure it,
install winbind, bind on a AD domain with an administrator, and finally
configure Apache to use this auth. You also need to be sure that your java
container won't try to authenticate itself. See:
http://adldap.sourceforge.net/wiki/doku.php?id=seamless_authentication if
you haven't found this before.

I don't know any other solution without using samba or krb.

Good luck!

Guillaume Fenollar
XWiki SAS

2012/9/11 Schmidt, Thilo (VZ) <Thilo.Schmidt at vdek.com>

Post by Schmidt, Thilo (VZ)
Hello,
I'm trying to get some kind of NTLM authentication going on my Debian
server, but got lost very early.
I find mentions of working NTLM solutions in the archives as well as some
fixes for an ominous "NTLM authenticator" (XCONTRIB-84) in Jira.
I even found some installation-guide in the sandbox, but there seems to be no jar file.
Is there some kind of working NTLM solution without installing kerberos or samba?
Thanks in advance,
Thilo
_______________________________________________
users mailing list
users at xwiki.org
http://lists.xwiki.org/mailman/listinfo/users

[Schmidt, Thilo (VZ)]

Thanks for the reply and link.
It just seems to me that running tomcat, apache, samba, kerberos and winbind on a machine "just" to run a wiki is a little much, especially considering that I'm new to this unix/server world ;)
Of course I'll do that if there isn't another way, i just have a hard time believing that there's no "simpler" solution to a very basic problem.
To clarify: I only need users to log in automatically to the wiki, Checking against the AD would be a bonus, but I could just create the wiki-accounts by hand, as well.

Intimidated by this strange world,
Thilo

Post by Guillaume Fenollar
Hi Thilo,
I worked a lot on this subject these two last days. But I only experimented
Kerberos, and Samba/Winbind/NTLM.
Why don't you want to install Samba? It's easier to make it work than a
Kerberos system (from what I saw). You have to install Samba, configure it,
install winbind, bind on a AD domain with an administrator, and finally
configure Apache to use this auth. You also need to be sure that your java
http://adldap.sourceforge.net/wiki/doku.php?id=seamless_authentication
if you haven't found this before.
I don't know any other solution without using samba or krb.
Good luck!
Guillaume Fenollar
XWiki SAS
2012/9/11 Schmidt, Thilo (VZ) <Thilo.Schmidt at vdek.com>

Post by Schmidt, Thilo (VZ)
Hello,
I'm trying to get some kind of NTLM authentication going on my Debian
server, but got lost very early.
I find mentions of working NTLM solutions in the archives as well as
some fixes for an ominous "NTLM authenticator" (XCONTRIB-84) in Jira.
I even found some installation-guide in the sandbox, but there seems to be no jar file.
Is there some kind of working NTLM solution without installing kerberos or samba?
Thanks in advance,
Thilo
_______________________________________________
users mailing list
users at xwiki.org
http://lists.xwiki.org/mailman/listinfo/users

_______________________________________________
users mailing list
users at xwiki.org
http://lists.xwiki.org/mailman/listinfo/users

[Aouali, Mouloud (Ext)]

Hi everyone,

Some of my users get a "Failed to execute the [velocity] macro" error in the "Recent Changes" section after update to version 4.2-MILESTONE-2. Others don't...

I really don't know how to resolve this. I thought about a "privileges" probleme since only some users get this error at loging but how can I resolve it

There is a similar error here in the xwiki-based XWiki website ! http://playground.xwiki.org/xwiki/bin/view/Main/RecentChanges

The full error stack is in the attachement

Thanks for your help

Regards

Ce message et toutes les pi?ces jointes (ci-apr?s le < message >) sont confidentiels et ?tablis ? l'intention exclusive de ses destinataires. Toute utilisation de ce message non conforme ? sa destination, toute diffusion ou toute publication, totale ou partielle, est interdite, sauf autorisation expresse. Si vous recevez ce message par erreur, merci de le d?truire sans en conserver de copie et d'en avertir imm?diatement l'exp?diteur. Internet ne permettant pas de garantir l'int?grit? de ce message, la Caisse des D?p?ts et Consignations d?cline toute responsabilit? au titre de ce message s'il a ?t? modifi?, alt?r?, d?form? ou falsifi?. Par ailleurs et malgr? toutes les pr?cautions prises pour ?viter la pr?sence de virus dans nos envois, nous vous recommandons de prendre, de votre c?t?, les mesures permettant d'assurer la non-introduction de virus dans votre syst?me informatique.

This email message and any attachments ("the email") are confidential and intended only for the recipient(s) indicated. If you are not an intented recipient, please be advised that any use, dissemination, forwarding or copying of this email whatsoever is prohibited without Caisse des Depots et Consignations's prior written consent. If you have received this email in error, please delete it without saving a copy and notify the sender immediately. Internet emails are not necessarily secured, and declines responsibility for any changes that may have been made to this email after it was sent. While we take all reasonable precautions to ensure that viruses are not transmitted via emails, we recommend that you take your own measures to prevent viruses from entering your computer system.

[Edo Beutler]

Hi Thilo

I'm a bit late to the party, but I have an addition:
Around two years ago we implemented a solution using NTLM / SSO with
AD using Jespa (http://www.ioplex.com/) for one of our customers. This
solution worked pretty well. The downside of Jespa is, that it is a
commercial product, thus it is neither free, nor open, but in my
opinion the pricing is reasonable, considering AD is mostly used in
larger companies.

Hope this helps
Edo

On Wed, Sep 12, 2012 at 9:21 AM, Schmidt, Thilo (VZ)

Post by Schmidt, Thilo (VZ)
Thanks for the reply and link.
It just seems to me that running tomcat, apache, samba, kerberos and winbind on a machine "just" to run a wiki is a little much, especially considering that I'm new to this unix/server world ;)
Of course I'll do that if there isn't another way, i just have a hard time believing that there's no "simpler" solution to a very basic problem.
To clarify: I only need users to log in automatically to the wiki, Checking against the AD would be a bonus, but I could just create the wiki-accounts by hand, as well.
Intimidated by this strange world,
Thilo

Post by Guillaume Fenollar
Hi Thilo,
I worked a lot on this subject these two last days. But I only experimented
Kerberos, and Samba/Winbind/NTLM.
Why don't you want to install Samba? It's easier to make it work than a
Kerberos system (from what I saw). You have to install Samba, configure it,
install winbind, bind on a AD domain with an administrator, and finally
configure Apache to use this auth. You also need to be sure that your java
http://adldap.sourceforge.net/wiki/doku.php?id=seamless_authentication
if you haven't found this before.
I don't know any other solution without using samba or krb.
Good luck!
Guillaume Fenollar
XWiki SAS
2012/9/11 Schmidt, Thilo (VZ) <Thilo.Schmidt at vdek.com>

Post by Schmidt, Thilo (VZ)
Hello,
I'm trying to get some kind of NTLM authentication going on my Debian
server, but got lost very early.
I find mentions of working NTLM solutions in the archives as well as
some fixes for an ominous "NTLM authenticator" (XCONTRIB-84) in Jira.
I even found some installation-guide in the sandbox, but there seems
to be no jar file.
Is there some kind of working NTLM solution without installing kerberos or samba?
Thanks in advance,
Thilo
_______________________________________________
users mailing list
users at xwiki.org
http://lists.xwiki.org/mailman/listinfo/users

_______________________________________________
users mailing list
users at xwiki.org
http://lists.xwiki.org/mailman/listinfo/users

_______________________________________________
users mailing list
users at xwiki.org
http://lists.xwiki.org/mailman/listinfo/users

[Ludovic Dubost]

Hi Thilo,

As Guillaume Fenollar says, NTLM will require Microsoft protocols,
hence the need for Samba.
But if your objective is just to implement single sign on on Linux you
can go with other standards:

- CAS (more simple)
- Kerberos (complicated)

You just need to setup a CAS Server (there are open source
implementations see http://www.jasig.org/cas)
You need an Apache HTTPD CAS module
You then can use XWiki's AppServer Trusted Authentication

You can probably find a CAS Server that can authenticate on an LDAP Server

Ludovic

Post by Schmidt, Thilo (VZ)
Thanks for the reply and link.
It just seems to me that running tomcat, apache, samba, kerberos and winbind on a machine "just" to run a wiki is a little much, especially considering that I'm new to this unix/server world ;)
Of course I'll do that if there isn't another way, i just have a hard time believing that there's no "simpler" solution to a very basic problem.
To clarify: I only need users to log in automatically to the wiki, Checking against the AD would be a bonus, but I could just create the wiki-accounts by hand, as well.
Intimidated by this strange world,
Thilo

Post by Guillaume Fenollar
Hi Thilo,
I worked a lot on this subject these two last days. But I only experimented
Kerberos, and Samba/Winbind/NTLM.
Why don't you want to install Samba? It's easier to make it work than a
Kerberos system (from what I saw). You have to install Samba, configure it,
install winbind, bind on a AD domain with an administrator, and finally
configure Apache to use this auth. You also need to be sure that your java
http://adldap.sourceforge.net/wiki/doku.php?id=seamless_authentication
if you haven't found this before.
I don't know any other solution without using samba or krb.
Good luck!
Guillaume Fenollar
XWiki SAS
2012/9/11 Schmidt, Thilo (VZ) <Thilo.Schmidt at vdek.com>

Post by Schmidt, Thilo (VZ)
Hello,
I'm trying to get some kind of NTLM authentication going on my Debian
server, but got lost very early.
I find mentions of working NTLM solutions in the archives as well as
some fixes for an ominous "NTLM authenticator" (XCONTRIB-84) in Jira.
I even found some installation-guide in the sandbox, but there seems
to be no jar file.
Is there some kind of working NTLM solution without installing kerberos or samba?
Thanks in advance,
Thilo
_______________________________________________
users mailing list
users at xwiki.org
http://lists.xwiki.org/mailman/listinfo/users

_______________________________________________
users mailing list
users at xwiki.org
http://lists.xwiki.org/mailman/listinfo/users

_______________________________________________
users mailing list
users at xwiki.org
http://lists.xwiki.org/mailman/listinfo/users