Re: Pass-through LDAP authentication with Internet Explorer and Active Directory

["Clayton Hicklin" <chicklin@xxxxxxxxx>]

On Tue, Sep 16, 2008 at 3:37 PM, Eric Covener <covener@xxxxxxxxx> wrote:

>> So, it looks like I need mod_setenvif, right?  Could anybody write a quick
>> directive that would look at REMOTE_USER to see if there is a backslash
>> ("\"), and if there is, set the same variable to everything following the
>> backslash?  I think this would solve my problem.  I would rather use
>> mod_authnz_ldap that  mod_auth_sspi as it is included with Apache and is
>> well-supported.

The authentication/authorization modules don't read from the
REMOTE_USER environment variable.

--
Eric Covener
covener@xxxxxxxxx

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@xxxxxxxxxxxxxxxx
  "   from the digest: users-digest-unsubscribe@xxxxxxxxxxxxxxxx
For additional commands, e-mail: users-help@xxxxxxxxxxxxxxxx

Well, where are they getting their info?  This is what I'm getting in the error log:

[5028] auth_ldap authenticate: user WHQ_NT_DOMAIN\\ch017001 authentication failed; URI /scpmanager/ [User not found][No Such Object]

Clearly domain\user is getting passed to the authn/authz modules from IE somehow or another.

--
Clayton Hicklin
chicklin@xxxxxxxxx