--- webserver_auth/webserver_auth.module	2008-08-07 18:38:49.000000000 +0200
+++ webserver_auth.module	2008-08-25 22:42:18.000000000 +0200
@@ -1,6 +1,11 @@
 <?php
 // $Id: webserver_auth.module,v 1.22.2.1 2008/08/07 16:38:49 weitzman Exp $
 
+define('WEBSERVER_AUTH_BASIC',	0);
+define('WEBSERVER_AUTH_DIGEST',	1);
+define('WEBSERVER_AUTH_NTLM',	2);
+
+
 /**
  * Implementation of hook_menu().
  */
@@ -37,25 +42,75 @@
   unset($_SERVER['PHP_AUTH_USER'], $_SERVER['PHP_AUTH_PW']);
 
   // Retrieve user credentials
-  $result = db_query("SELECT uid FROM {authmap} WHERE authname = '%s' AND module = 'webserver_auth'", $authname);
+  $result = db_query("SELECT uid FROM {authmap} WHERE authname = '%s' AND module = 'ldapauth' OR module = 'webserver_auth'", $authname);
   $expected = db_fetch_array($result);
 
+  // this doesnt work with admin account 1
   if (isset($user) && $user->uid === $expected['uid']) {
-    // Do nothing: user is already logged into Drupal with session data matching
-    // HTTP authentication.
+    $userchanged = FALSE;
+  }
+  else {
+    $userchanged = TRUE;
+  }
+
+  // no idea how to check if this is a relogin...
+  $relogin = FALSE;
+ // $relogin = TRUE; // switch by hand ;-)
+
+  if (variable_get('webserver_auth_allow_logout',FALSE) == 1 && $relogin === FALSE) {
+    if (trim($_GET['q']) == "logout" && ! $userchanged) {
+
+      // compare next 10 lines with user_logout() in modules/user/user.pages.inc
+
+      watchdog('user', 'Session closed for %name.', array('%name' => $user->name));
+
+      // Destroy the current session:
+      session_destroy();
+      module_invoke_all('user', 'logout', NULL, $user);
+
+      // Load the anonymous user
+      $user = drupal_anonymous_user();
+
+      drupal_goto("webserver_logout"); 
+      exit;
+
+    } 
+    else if (trim($_GET['q']) == "webserver_logout" && $userchanged) {
+      header('WWW-Authenticate: Negotiate');
+      switch (variable_get('webserver_auth_logout_type', FALSE)) {
+      case WEBSERVER_AUTH_BASIC:
+        $realm = variable_get('webserver_auth_logout_realm',t('please set the realm to the same as in the login dialog'));
+        header("WWW-Authenticate: Basic realm=\"$realm\"",false);
+        break;
+      case WEBSERVER_AUTH_DIGEST:
+        // not implemented yet
+        break;
+      case WEBSERVER_AUTH_NTLM:
+        header('WWW-Authenticate: NTLM', false);
+        break;
+      default:
+        // don't know what to do ...
+      }
+      //header("HTTP/1.0 401 Unauthorized");
+      exit;
+    }
   }
   else {
-    if (!empty($authname)) {
-      // User is logged into webserver via HTTP authentication.
-      // Try to log into Drupal. 
-      $user = user_external_load($authname);
-
-      if (!$user) {
-        // If unsuccessful, register the user. This will trigger
-        // webserver_auth_user() and any other _user() hooks.
-        user_external_login_register($authname, 'webserver_auth');
+    if ($userchanged) {
+      if (!empty($authname)) {
+        // User is logged into webserver via HTTP authentication.
+        // Try to log into Drupal. 
+        $user = user_external_load($authname);
+
+        if (!$user) {
+          // If unsuccessful, register the user. This will trigger
+          // webserver_auth_user() and any other _user() hooks.
+          user_external_login_register($authname, 'webserver_auth');
+        }
       }
     }
+      // else: Do nothing: user is already logged into Drupal with session data matching
+      // HTTP authentication.
   }
 }
 
@@ -129,5 +184,41 @@
       '#description' => t("Modify user accounts at the time of creation. Use PHP code (enclosed in <code>&lt;?php</code> and <code>?&gt;</code>). The variable <code>\$account</code> is available as in <a href=\"http://api.drupal.org/api/function/hook_user/6\">hook_user('insert',...)</a>. Changes to the user object must be explicitly saved to the database to be made permanent."),
     ),
   );
+
+  $options_logout_type = array(
+    WEBSERVER_AUTH_BASIC => 'Basic',
+    WEBSERVER_AUTH_DIGEST => 'Digest (not yet implemented)',
+    WEBSERVER_AUTH_NTLM => 'NTLM'
+  );
+
+  $form['logout_settings'] = array(
+    '#type' => 'fieldset',
+    '#title' => t('Logout settings'),
+    '#collapsible' => TRUE,
+    '#collapsed' => TRUE,
+    'webserver_auth_allow_logout' => array(
+      '#type' => 'checkbox',
+      '#title' => t('Allow drupal to logout webserver authentication?'),
+      '#default_value' => variable_get('webserver_auth_allow_logout', FALSE),
+      '#description' => t("If you check this box, drupal resets the webserver authentication on logout. If not set, nothing will be happen on logout, user keeps logged in.")
+    ),
+    'webserver_auth_logout_type' => array(
+      '#type' => 'radios',
+      '#title' => t('Choose authentication mode'),
+      '#default_value' => variable_get('webserver_auth_allow_logout', FALSE),
+      '#description' => t('Choose, which authentication type was used by the webserver.'),
+      '#default_value' => variable_get('webserver_auth_logout_type', WEBSERVER_AUTH_BASIC),
+      '#options' => $options_logout_type
+    ),
+    'webserver_auth_logout_realm' => array(
+      '#type' => 'textfield',
+      '#title' => t('Basic Realm'),
+      '#size' => 30,
+      '#maxlength' => 55,
+      '#default_value' => variable_get('webserver_auth_logout_realm', FALSE),
+      '#description' => t("If the Webserver authentication type is set to Basic above, then give the Realm in this field:")
+    )
+  );
+
   return system_settings_form($form);
 }