将 NTLM Active Directory 用户数据检索到 Rails（无需 IIS）
我相信我们可以允许 Firefox 将 NTLM 数据发送到 SharePoint 站点进行自动身份验证，并且我认为这对于 IIS 是可行的。
我想对内部 Rails 站点做同样的事情。
有谁知道我可以通过 Apache/mongrel 设置来验证 NTLM 类型用户信息的方法（当然前提是它已经在 Active Directory 域内的 Windows 机器上运行）？
I believe that we can allow Firefox to sent NTLM data to SharePoint sites to do automatic authentication, and I think that this is doable with IIS.
I'd like to do the same thing with an internal Rails site.
Does anyone know of way that I could authenticate NTLM type user information through a Apache/mongrel setup (provided of course that it's already running on a Windows box inside of an Active Directory domain)?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（7）
我创建了 有关如何安装的教程为 Linux 上的 Apache 修补了 mod_ntlm 模块，以及如何将经过 NTLM 身份验证的用户名传递给 Rails 以及如何从中创建 Rails 会话。 因此，您不需要 Windows 服务器来运行 Rails 应用程序。
您还可以找到如何在 Firefox 中启用自动 NTLM 身份验证 — 在位置字段中输入“about:config”，然后搜索“network.automatic-ntlm-auth.trusted-uris”。 您可以在此处输入要使用自动 NTLM 身份验证的服务器。
I created tutorial on how to install patched mod_ntlm module for Apache on Linux and how to pass NTLM authenticated username to Rails and how create Rails session from that. So as a result you do not need Windows server for running Rails application.
There you can find also how to enable automatic NTLM authentication in Firefox — enter "about:config" in location field and then search for "network.automatic-ntlm-auth.trusted-uris". There you can enter servers for which you would like to use automatic NTLM authentication.
一些额外的信息，以防有人偶然发现这一点。
我想做一些我认为应该非常简单的事情 - 使用 NTLM 从 Mongrel/Windows 上运行的 Rails 应用程序（实际上是 InstantRails）中提取用户的 Windows 用户名。 编写基本代码后，管理各种握手操作（使用 http://rubyforge.org/ 上出色的 NTLMRuby 库） items/rubyntlm/）并让它在 Firefox 中完美运行，但我发现 IE 无法运行而感到有些沮丧。
Mongrel 在 type1/2/3 消息交换期间不支持 keep-alives（至少在本机上，我相信有一个 hack/fix），而 IE 需要这一点，而 Firefox 则不需要。
因此，针对远程 NTLM 服务（例如 Sharepoint 或其他网站）对 Windows 上运行的 Rails 服务器进行身份验证相当简单，但针对 Windows 上运行的 Rails 服务器对 IE 浏览器进行身份验证，而使用 Mongrel 则不然。 IIS 将是一个选项，就像带有 FastCGI 的基本 Apache 一样。 前者感觉有点笨重，后者则不如 Mongrel 快。
Bit of extra info in case anyone stumbles across this.
I wanted to do something which I thought should be pretty simple - extract the users windows username using NTLM from a Rails app running on Mongrel/Windows (InstantRails actually). Having written the basic code manage the various handshaking operations (using the great NTLMRuby library at http://rubyforge.org/projects/rubyntlm/) and having got it to work wonderfully in Firefox I was somewhat frustrated to find IE not working.
Mongrel doesn't support keep-alives during the type1/2/3 message exchange (at least natively, I believe there's a hack/fix for it), which IE demands and Firefox gets by without.
So authenticating a Rails server running on Windows against a remote NTLM service (e.g. Sharepoint or another web site) is reasonably straight forward, but authenticating an IE browser against a Rails server running on Windows not so much with Mongrel. IIS would be an option, as might be basic Apache with FastCGI. The former feels a bit clunky and the latter won't be as fast as Mongrel.
我假设您已经计算出需要发送哪些 HTTP 标头才能让 Firefox 和 IE 发回 NTLM 身份验证内容，并且只需要在服务器端处理该内容？
您可以使用 ruby 的一些 win32 库来访问处理 NTLM 的底层 Windows 身份验证函数。
我建议阻力最小的方法可能是查看是否有 COM 组件可以为您进行身份验证，如果有，则使用 Win32OLE ruby 库来使用它。
如果没有 COM 组件，您可能可以在其他库之一中找到可以为您调用本机 win32 方法的内容。
如果找不到，则必须编写 ruby C 扩展。 我已经在 Linux 上完成了此操作，并且扩展 ruby 非常容易，但您可能会发现 microsoft 身份验证 API 有点痛苦。
希望这能让您走上正确的道路:-)
I'm assuming you've already worked out which HTTP headers you need to send in order to get firefox and IE to send back the NTLM authentication stuff, and are just needing to handle that on the server side?
You could use some of ruby's win32 libraries to access the underlying windows authentication functions which handle the NTLM.
I'd suggest the path of least resistance might be to see if there is a COM component which can do the authentication for you, and if so, to use it using the Win32OLE ruby library.
If there's no COM component, you might be able to find something in one of those other libraries which can invoke the native win32 methods for you.
If you can't find that, you'd have to write a ruby C extension. I've done this on linux, and extending ruby is pretty easy, but you may find the microsoft authentication API's a bit painful.
Hope that gets you started on the right track :-)
您还可以使用 Apache ntlm 模块，该模块应使用以下用户名将标头向前传递到您的应用程序经过身份验证的用户。 该模块看起来有点旧，但建议一些其他模块可能适合您的需求。
You could also use the Apache ntlm module, which should pass a header onwards to your application with the username of the authenticated user. That module looks a bit old, but suggests some other modules that may suit your needs.
我知道这个老问题，但我在寻找类似的答案时遇到了这个问题。
您可以使用此处描述的方法（http://blog.rayapps.com/2008/12/02/ntlm-windows-domain-authentication-for-rails-application/）。 然而 mod_ntlm 用于 UNIX/linux 机器上的 Windows 身份验证。 mod_auth_sspi 是您在 Windows 下从 apache 进行 winNT 身份验证所需的内容。
Old question I know but I came across this looking for a similar answer.
you could use the methods described here (http://blog.rayapps.com/2008/12/02/ntlm-windows-domain-authentication-for-rails-application/). However mod_ntlm is for windows authentication on a UNIX/linux machine. mod_auth_sspi is what you'll need for winNT authentication from apache under windows.
这个特定的项目看起来很有前途，正在寻找贡献者：
我还没有尝试过这个。 目前我计划实施 Raimonds 的解决方案，因为它似乎取得了很大的成功。
This particular project looks promising and is looking for contributors:
I haven't yet tried this out. For the moment I plan on implementing Raimonds' solution as it appears to have a lot of success.
查看华夫饼。 它使用 Win32 API 在 Windows 上提供到 Java 服务器的 SSO。 有许多已实现的过滤器（servlet、tomcat Valve、spring-security）。
Check out Waffle. It provides SSO on Windows to Java servers using Win32 API. There're a number of implemented filters (servlet, tomcat valve, spring-security).