如何使用 Microsoft AD 为内部 PHP 应用程序实现单点登录 (SSO)？
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/1003751/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
How can I implement single sign-on (SSO) using Microsoft AD for an internal PHP app?
提问by reconbot
I'm vaguely aware that on a computer joined to a domain IE can be asked to send some extra headers that I could use to automatically sign on to an application. I've got apache running on a windows server with mod_php. I'd like to be able to avoid the user having to log in if necessary. I've found some links talking about Kerberos and Apache modules.
我隐约知道，在加入域的计算机上，可能会要求 IE 发送一些额外的标头，我可以使用这些标头自动登录到应用程序。我已经在带有 mod_php 的 Windows 服务器上运行了 apache。我希望能够避免用户在必要时登录。我找到了一些讨论 Kerberos 和 Apache 模块的链接。
http://www.onlamp.com/pub/a/onlamp/2003/09/11/kerberos.html?page=lasthttps://metacpan.org/pod/Apache2::AuthenNTLM
http://www.onlamp.com/pub/a/onlamp/2003/09/11/kerberos.html?page=last https://metacpan.org/pod/Apache2::AuthenNTLM
Since I'm running on Windows it's proven to be non-trivial to get Perl or Apache modules installed. But doesn't PHP already have access to HTTP headers?
由于我在 Windows 上运行，事实证明安装 Perl 或 Apache 模块并非易事。但是 PHP 不是已经可以访问 HTTP 标头了吗？
I found this but it doesn't do any authentication, it just shows that PHP can read the NTLM headers. http://siphon9.net/loune/2007/10/simple-lightweight-ntlm-in-php/
我发现了这个，但它没有做任何身份验证，它只是表明 PHP 可以读取 NTLM 标头。 http://siphon9.net/loune/2007/10/simple-lightweight-ntlm-in-php/
I'd like to be able to have my users just point to the application and have them automatically authenticated. Has anyone had any experience with this or gotten it to work at all?
我希望能够让我的用户只指向应用程序并让他们自动进行身份验证。有没有人有这方面的经验或让它发挥作用？
UPDATESince originally posting this question, we've changed setups to nginx and php-fcgi still running on windows. Apache2 and php-cgi on windows is probably one of the slowest setups you could configure on windows. It's looking like Apache might still be needed (it works with php-fcgi) but I would prefer a nginx solution.
更新自最初发布此问题以来，我们已将设置更改为 nginx 和 php-fcgi 仍在 Windows 上运行。Windows 上的 Apache2 和 php-cgi 可能是您可以在 Windows 上配置的最慢的设置之一。看起来可能仍然需要 Apache（它适用于 php-fcgi），但我更喜欢 nginx 解决方案。
I also still don't understand (and would love to be educated) why HTTP server plugins are necessary and we can't have a PHP, web server agnostic solution.
我仍然不明白（并且很想接受教育）为什么 HTTP 服务器插件是必要的，我们不能有一个 PHP、Web 服务器不可知的解决方案。
采纳答案by realMarkusSchmidt
All you need is the mod_auth_sspiApache module.
您所需要的只是mod_auth_sspiApache 模块。
Sample configuration:
示例配置：
AuthType SSPI
SSPIAuth On
SSPIAuthoritative On
SSPIDomain mydomain
# Set this if you want to allow access with clients that do not support NTLM, or via proxy from outside. Don't forget to require SSL in this case!
SSPIOfferBasic On
# Set this if you have only one domain and don't want the MYDOMAIN\ prefix on each user name
SSPIOmitDomain On
# AD user names are case-insensitive, so use this for normalization if your application's user names are case-sensitive
SSPIUsernameCase Lower
AuthName "Some text to prompt for domain credentials"
Require valid-user
And don't forget that you can also use Firefox for transparent SSO in a Windows domain: Simply go to about:config, search for network.automatic-ntlm-auth.trusted-uris, and enter the host name or FQDN of your internal application (like myserver or myserver.corp.domain.com). You can have more than one entry, it's a comma-separated list.
并且不要忘记，您还可以在 Windows 域中使用 Firefox 进行透明 SSO：只需转到about:config，搜索network.automatic-ntlm-auth.trusted-uris并输入您的内部应用程序的主机名或 FQDN（如 myserver 或 myserver.corp.domain.com）。您可以有多个条目，它是一个以逗号分隔的列表。
回答by asgeo1
回答by Benjamin Oakes
I'd be curious about a solution that uses OpenID as a backend (of sorts) for this... I wasn't seeing anything that would hook into ActiveDirectory directly when I googled (quickly). However, it could be pretty painless to implement over plain HTTP(S) (you'd be an OpenID provider that checked credentials against your local AD). In a best case scenario, you might be able to just add a couple classes to your app and be off and running -- no web server modules required. There is a lot of open source code out there for either side of this, so if nothing else, it's worth taking a look. If you exposed the backend to the users (i.e. gave them OpenID URLs), you'd have the added benefit of them being able to log in to more than just your internal sites using these credentials. (Example: Stack Overflow.)
我很好奇使用 OpenID 作为后端（各种）的解决方案......当我（快速）搜索时，我没有看到任何可以直接连接到 ActiveDirectory 的东西。但是，通过纯 HTTP(S) 实现可能非常轻松（您将成为 OpenID 提供者，根据您的本地 AD 检查凭据）。在最好的情况下，您可能只需向您的应用程序添加几个类，然后就可以关闭并运行——不需要 Web 服务器模块。这方面有很多开源代码，所以如果没有别的，值得一看。如果您向用户公开后端（即给他们 OpenID URL），您将获得额外的好处，即他们能够使用这些凭据登录到更多的内部站点。（例如：堆栈溢出。）
As an aside, I'd be against making it so that Internet Explorer is required. I'm not sure if that is the goal from the way you wrote the question, but depending on your IT environment, I'd expect people who use Firefox or Safari (or Opera or ...) to be less than enthusiastic. (You're not developing against IE first, are you? That's been painful whenever I've done so.) This is not to say that you couldn't use this feature of IE, just that it shouldn't be the only option. The link you posted stated that NTLM worked with more than IE, but since I don't have any experience with it, it's hard to judge how well that would work.
顺便说一句，我反对这样做，因此需要 Internet Explorer。我不确定这是否是您编写问题的方式的目标，但根据您的 IT 环境，我希望使用 Firefox 或 Safari（或 Opera 或 ...）的人不那么热情。（您不是首先针对 IE 进行开发，是吗？每当我这样做时，这都很痛苦。）这并不是说您不能使用 IE 的此功能，只是它不应该是唯一的选择. 您发布的链接指出 NTLM 不仅适用于 IE，但由于我没有任何经验，因此很难判断它的效果如何。
回答by Hrishi
One option for you is to use CAS (central authentication service).
您的一种选择是使用 CAS（中央身份验证服务）。
It has php client library.
它有php客户端库。
How-to link to MS Active Directory: http://www.ja-sig.org/wiki/display/CASUM/Active+Directory
如何链接到 MS Active Directory：http: //www.ja-sig.org/wiki/display/CASUM/Active+Directory
You would require Apache maven 2 though.
不过，您将需要 Apache maven 2。
回答by Will Shaver
For IIS/PHP FCGI, You need to send out an unauthorized header:
对于 IIS/PHP FCGI，您需要发送未经授权的标头：
function EnableAuthentication()
{
$realm = "yoursite";
header('WWW-Authenticate: Digest realm="'.$realm.'",qop="auth",nonce="'.uniqid().'",opaque="'.md5($realm).'"');
header("HTTP/1.1 401 Unauthorized");
exit;
}
You can then get at the username with:
然后，您可以通过以下方式获取用户名：
$winuser = $_SERVER["REMOTE_USER"];
I then make sure the $winuser is in my database of allowed users.
然后我确保 $winuser 在我的允许用户数据库中。
Be SURE and test this under a non-privileged account. When I first installed this I tested it and it worked fine, but later when a standard non-server-admin user tried it this failed. Turns out some of the temporary directories need to have permissions changed for guest users. I can't recall the exact settings.
请确保并在非特权帐户下进行测试。当我第一次安装它时，我测试了它并且它运行良好，但后来当标准的非服务器管理员用户尝试它时失败了。事实证明，一些临时目录需要为来宾用户更改权限。我不记得确切的设置。
