NTLM Auth without prompt for require valid-user and PHP

Question

I want to redirect to a login page without the htaccess prompt showing up if a valid-user is not found

i have a working htaccess auth

AuthName "My name"
NTLMBasicRealm "DOM"
NTLMAuth on
NegotiateAuth off
NTLMAuthHelper "/usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp"
NegotiateAuthHelper "/usr/bin/ntlm_auth --helper-protocol=gss-spnego"
NTLMBasicAuthoritative on
AuthType NTLM
AuthType Negotiate
Require valid-user 

ErrorDocument 401 /index.php

Which sets the Windows name as $_SERVER['REMOTE_USER'] as long as a valid-user is found. if not the htaccess prompt pops up and you need to manually cancel it to get redirected

if i remove Require valid-user, $_SERVER['REMOTE_USER'] is null.

Is there a way to Authenticate an User but if not automatically found redirect without prompt?

score 1 · Accepted Answer · answered Jun 07 '20 at 00:42

The first step in Windows Authentication is returning an HTTP 401 response to the browser. If the site is trusted, the browser will automatically send the current user's credentials. If not, the browser prompts for credentials. There is no way to change that behavior.

But you could refactor your site a bit. I described in another answer how to attempt Windows Authentication in the background and fall back to forms authentication. That answer is specific to ASP.NET, but the same thing can be done with PHP and Apache too (although I can't tell you exactly how to do it).

The basic idea is:

Your main authentication mechanism for your website is forms authentication.
On your login page, hide everything on the page at first.
On your login page, make an AJAX request to a URL that is configured for Windows authentication.
On the server side, if authentication to that URL succeeds, you do the same thing you do for a successful forms login (usually, set the cookie).
On your login page, if that AJAX request succeeds, you forward the user to the page they want.
If that AJAX request fails, show everything on the login page and they can type in their username and password there.

NTLM Auth without prompt for require valid-user and PHP

1 Answers1