3

I'm using Jespa to do transparent ntlm sign on. I want to be able to authenticate the users in multiple windows domains. I have it working with one domain. How do I add another?

Thanks

Sam Backus
  • 1,693
  • 14
  • 19
  • I thought that I might be able to use a ChainSecurityProvider but the documentation says that "Only the first SecurityProvider in a chain can perform SSO authentication." Why can't I chain together ntlmSecurityProviders? – Sam Backus Aug 15 '11 at 19:52
  • Note that if domains have trusts, it should all just work. Jespa fully supports cross domain authentication with trusts. You don't need to do anything special. This question is apparently about domains that do NOT have trusts in which case the answer below is applicable. But if you have any doubt, you should email ioplex support. – squarewav Oct 27 '17 at 16:39

1 Answers1

1

I asked this question to ioplex support. They gave me a good answer. Here it is:

"Only the first element in the chain can do SSO because once the HttpSecurityService challenges the browser with information for the first domain, the browser cannot start over for a different domain. At least not in the same request. Ideally it would be great if the browser submitted the name of it's own domain in the initial NTLM token. But unfortunately it simply does not.

We actually get this question quite a bit. The best way to handle this in our opinion is to create a custom Filter that creates multiple instances of the HttpSecurityService - one for each domain. Then you have a parallel list of network masks that can be used to match clients by remote IP address to the correct instance of the HttpSecurityService. Or you could identify clients using any method you want such as broswer signature. Or you could use a cookie to identify the ideal domain but in this case the user would have to do something to get the cookie (like login manually once). Do you understand what I mean?

Note that if the AD domains have trusts, SSO should work fine with only the one HttpSecurityService instance. The solution described above is only necessary if the domains do not have trust relationships."

Sam Backus
  • 1,693
  • 14
  • 19