Message

Hi Tomcat Developpers!

(Message resent with missing NtlmAuthenticator.java)

I wanted to:

* centralize the parameterization of user authentication at the con= tainer level;

* have a simple NTLM authentication for intranet users;

* be able to run Tomcat in a Microsoft Active Directory network where the s= erver is secured (absolutely no login allowed to regular users)

There is a Microsoft “specification” (bug?) by which all LD= AP binds are evaluated on the Domain Server (like if the user was attempting t= o login on the Domain Server).

It would be better to have binds evaluated as if they were originati= ng from the LDAP client machine (the Tomcat Server).

To circumvent this, I have been obliged to remove the binding (the p= assword checking) but to ensure that it is NTLM (and nothing else) which=20= provides the username.

The users are therefore automatically logged with the username used t= o log on their PC.

The attached patch is for current Apache Tomcat sources (6.0.18).

It adds:

An NTLM Authenticator: nothing to configure except in the web.x= ml of each application:
   <login-config>
       <auth-method>NTLM</auth-method>
       <realm-name>ThisI= sApassword</realm-name>
   </login-config>

The realm-name is the “password&= #8221; which ensures that authentication is done by NTLM and no other method.

A very long password is strongly recom= mended.

A modified JNDI Realm with new parameters:

preAuthenticatedPassword=3D= ”ThisIsApassword”
This to suppress password checking if preAuthenticatedPassw= ord is provided.
userIdentification=3DR= 21;userPrincipalName” provides a standardized username, whatever the retrieved us= er name (case of complex userSearch patterns)
userNamePrefix and userNameSuffix
This to suppress a prefix and/or a suffix from username bef= ore returning it to the application: good to suppress domain identificati= on, etc.
When you user complex userSearch pattern, this can be very=20= useful. Example:
userSearch=3D"(|(sAMAccountName=3D{0= })(userPrincipalName=3D{0}@domain.com)(userPrincipalName=3D{0}))&= quot;
userIdentification=3D"userPrincipalName" userName= Prefix=3D”domain\” userNameSuffix=3D”@domain.com”

Hopes this can be useful to the community!

Please do not hesitate to ask me what I should do to make this contribut= ion perennial.

Wishing you a very nice weekend,

Christophe Dupriez

Centre Antipoisons - Antigifcentrum

C/o H=F4pital Central de la Base Reine Astrid

Rue Bruyn - 1120 Bruxelles - Belgique

tel 32-(0)2.264.96.36 fax 32-(0)2.264.96.46