Configuring Drupal for NTLM using the LDAP Module

Submitted by hernani on Tue, 11/27/2012 - 09:55

This week I was working with a Client that had a pretty common requirement found in Intranets: seamless login for users authenticated in the domain. This is possible to achieve as long as the server is able to connect to the domain controller and recognize credentials used in the machine. I was able to achieve NTLM integration using the available perl module, however it does not support NTLM2 which is used since Windows Vista. Therefore I ended up using a python module.

Here is the method used to achieve it:



First installed apxs

yum install httpd-devel

Installed python-devel

yum --install python-devel

Downloaded and configured mod_python (

./configure --with-apxs=/usr/bin/apxs make make install

Edit /etc/httpd/conf/httpd.conf

LoadModule python_module modules/

Downloaded and installed PythonNTLM Authenticate module.

python install -f

Appended to /etc/httpd/conf/httpd.conf

<Directory "/user/login/sso">   AuthType NTLM AuthName WDOMAIN require valid-user   PythonAuthenHandler pyntlm PythonOption Domain PythonOption PDC PythonOption BDC   # Bypass authentication for local clients. # Comment these lines if they should authenticate too. Order deny,allow Deny from all Allow from Satisfy any   </Directory>

At this point if you point your browser to it should either ask you for username or password or recognize you as authenticated in the domain.

A good method to verify if everything is working is access a page with phpinfo information and verify that the variable $_SERVER['remote_user'] is well defined.

After achieving server NTLM authentication the only remaining bit is done directly by the LDAP module which contains a submodule that handles the authentication in Drupal (LDAP SSO).

- See more at: