Table of Contents

NTLM Authentication Backend

This page describes how to set up NTLM (i.e. Windows NT-based) authentication for DokuWiki running on Apache. As an added bonus, the second half of this page describes what you need to do to enable Firefox to “see” this configuration.

Note: For obvious reasons, this document assumes a DokuWiki install on Windows (perhaps using EasyPHP , XAMPP or Bitnami DocuWiki Stack)

Setup NTLM authentication for Apache

# Add to your httpd.conf
 
LoadModule ntlm_module modules/mod_ntlm.so
 
#
# Configuration for mod_ntlm
<IfModule mod_ntlm.c>
    <Location /protected/>
        AuthName "A Protected Place"
        AuthType NTLM
        NTLMAuth On
        NTLMAuthoritative On
        NTLMOfferBasic On
        NTLMBasicPreferred
        require valid-user
    </Location>
</IfModule>
# End of mod_ntlm.

Configure DokuWiki to use NTLM authentication

## Enable this to restrict editing to logged in users only 
AuthType NTLM 
NTLMAuth On 
NTLMAuthoritative on 
 
require valid-user
$conf['useacl']      = 1;               //Set this to 1 to enable ACLs
$conf['authtype']    = 'ntlm';          //Change this to 'ntlm'
$conf['passcrypt']   = 'md5';           //Change this to md5. It's smd5 by default
// do the login either by cookie or provided credentials
if($conf['useacl']){
	if($auth){
		if (!isset($_REQUEST['u'])) $_REQUEST['u'] = '';
		if (!isset($_REQUEST['p'])) $_REQUEST['p'] = '';
		if (!isset($_REQUEST['r'])) $_REQUEST['r'] = '';
    // add this snippet
		if ($conf['authtype'] == 'ntlm')
		{
			$_REQUEST['u'] = getRemoteUserNice();
			$_REQUEST['p'] = "";
			$_REQUEST['r'] = "";
		}
    // end of snippet
 
		// if no credentials were given try to use HTTP auth (for SSO)
		if(empty($_REQUEST['u']) && empty($_COOKIE[DOKU_COOKIE]) && !empty($_SERVER['PHP_AUTH_USER'])){
			$_REQUEST['u'] = $_SERVER['PHP_AUTH_USER'];
			$_REQUEST['p'] = $_SERVER['PHP_AUTH_PW'];
		}
 
// this is a hack for ntlm_module (http://www.gknw.net/development/apache/apache-1.3/win32/modules/)
// for some reason it only sets env variable REMOTE_USER but not // $_SERVER['REMOTE_USER'] 
 
function getRemoteUser() {
  if ($_SERVER['REMOTE_USER'])
    return $_SERVER['REMOTE_USER'];
  return getenv('REMOTE_USER');
}
 
function niceNtlmUserName($userName)
{
  return preg_replace("/^.+\\\\/", "", $userName);
}
 
// NTLM user name is in the form "domain\\user", this
// function converts it to just "user"
function getRemoteUserNice()
{
    return  niceNtlmUserName(getRemoteUser());
}
 
//Setup VIM: ex: et ts=2 enc=utf-8 :
<?php
/**
 * NTLM authentication backend
 *
 * To use it:
 * - install ntlm module (e.g. mod_ntlm-1.3.zip from
 *   http://www.gknw.net/development/apache/apache-1.3/win32/modules/
 * - add the following to the .htaccess of your dokuwiki directory:
AuthType NTLMNTLMAuth on
NTLMAuthoritative on
require valid-user
 *   this will only allowed logged in and authenticated users to
 *   access pages and puts the login of the user in $REMOTE_USER env
 *   variable. This code relies on that
 * @author     Krzysztof Kowalczyk : http://blog.kowalczyk.info
 */
class auth_ntlm extends auth_basic {
 
	function auth_ntlm() {
 
// we only accept page ids for auth_plain
if(isset($_REQUEST['u']))
  $_REQUEST['u'] = cleanID($_REQUEST['u']);
}
/**
 * Check user+password [required auth function]
 *
 * @author     Krzysztof Kowalczyk : http://blog.kowalczyk.info
 * @return  bool
 */
function checkPass($user,$pass) {
 
  if (!getenv('REMOTE_USER'))
    return false;
  return true;
}
 
/**
 * Return user info [required auth function]
 *
 * Returns info about the given user needs to contain
 * at least these fields:
 *
 * name string  full name of the user
 * mail string  email addres of the user
 * grps array   list of groups the user is in
 *
 * @author     Krzysztof Kowalczyk : http://blog.kowalczyk.info
 */
function getUserData($user) {
  global $conf;
  $userInfo['name'] = niceNtlmUserName($user);
  $userInfo['mail'] = $userInfo['name'].'@solvay.com';
  $userInfo['grps'] = array($conf['defaultgroup']);
  return $userInfo;
}
 
/**
 * Create a new User [required auth function]
 *
 * Returns false if the user already exists, null when an error
 * occured and the cleartext password of the new user if
 * everything went well.
 *
 * The new user HAS TO be added to the default group by this
 * function!
 *
 * @author     Krzysztof Kowalczyk : http://blog.kowalczyk.info
 */
function createUser($user,$pass,$name,$mail){
  return false;
}
}
//Setup VIM: ex: et ts=2 enc=utf-8 :
?>

To access your site using Firefox:

See the link in the references section below

If all goes well, after you have configured Apache, DokuWiki and Firefox, open up your DokuWiki home page in Firefox, and it should detect your Windows credentials and log you in automatically. You should see your NT ID at the bottom of the screen, where it says, “Logged in as…”.

References