Mailing-List: contact users-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@httpd.apache.org
Received-SPF: pass (athena.apache.org: domain of listacctc@gmail.com
 designates 64.233.184.224 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=message-id:date:from:user-agent:mime-version:to:subject:content-type:content-transfer-encoding;
        b=LkWCLeP7kaijawdyfrliPlEMZOn3m49koy8z8cnfmW6hCzkd0ssUJL43oa3OiW8YfGfmZek+ZUk8A1Xe84t8pSvQQr2fREjGWEYBz/kSdzCpmgJGCVvhQGTD/97c4YYOzwPANq0vKiPqaifN22ZcWl20HDavq9klEgF572ZKtZs=
Message-ID: <4808E70D.1010405@gmail.com>
Date: Fri, 18 Apr 2008 14:23:09 -0400
From: Tod <listacctc@gmail.com>
User-Agent: Thunderbird 2.0.0.12 (Windows/20080213)
MIME-Version: 1.0
To: users@httpd.apache.org
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Subject: [users@httpd] Apache SSO using NTLM, LDAP ?

This has to be a frequently requested feature.  There seems to be so 
much written and done with it over the years that I wonder if some sort 
of standard process has emerged.

I have an apache2 web server and the need to seamlessly (hence SSO in 
title) authenticate and pass through IE6 clients.  mod_ntlm seems to fit 
the bill but now there is a more recent mod_auth_sspi that I wonder 
isn't more feasible.

I'm going to have a population of about 10K users hitting the web server 
  which translates into a lot of hits/second.  The web site I'm working 
on is not proxied and is not optimized for performance.  Its the 
hardware's brute force that is keeping things running smoothly, in my 
estimation.

I'd like to avoid injecting a performance problem, especially during 
authentication, that could add up to a lot of unsatisfied users in a 
very short period of time.

I also have the option (which I prefer) of using an LDAP directory to 
accomplish the authentication but the requirement of pass through 
authentication for IE still exists, as well as the performance hurdle.

So my questions are:

- Is mod_ntlm able to fit the bill and not incur a huge performance hit?
- Would mod_auth_sspi be a better solution using the same requirements?
- Is there a way I can authenticate users seamlessly using mod_auth_ldap?
- Is there maybe another solution, either apache mod or otherwise, 
someone can suggest that will fit the bill?


Thanks in advance!

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org