SSO: How to configure IIS?

I guess the Moodle stuff isn't very helpful.
They have a separate php file for that and we only have an URL.

IIS Configuration
Open the IIS Management Console and navigate to the auth/ldap/ntlmsso_magic.php file.
IIS 6.0
right click on the file, choose properties
under the "file security" tab, click on the Authentication and Access control "edit" button
untick "Enable Anonymous Access" and tick "Integrated Windows Authentication"

This article looks closer to the subject but I'm not that much of a windows guy.
http://support.microsoft.com/kb/326020/en-us?fr=1

Thanks anyway!

in my case the path is [drupal_root]/?q=user/login/sso or [drupal_root]/index.php?q=user/login/sso
I know that iis7 allows for the url rewrites and more easy to configure in general, but I have to deal with iis6.

Well, this code doesn't work in IIS 7 with URL Rewrite. is only good for a real file or folder and doesn't respect the rewrite rules or query string.

I wonder is there a way to make a separate php file to simulate index.php with q=user/login/sso? Sounds easy, I guess I should try.

Ok here's to get it (somewhat) working. IIS7, PHP as FastCGI, Drupal 7.10, latest LDAP dev with some hacks.

First of all, looks like you don't have to authenticate user on /user/login/sso itself, any page will do. Just ask for authentication on any page and then redirect to sso. Web server keeps setting $_SERVER['REMOTE_USER'] on every consequent request.

1. Make a copy of index.php and add these 2 lines after bootstrap.

if(!$user->uid) drupal_goto('user/login/sso');
else drupal_goto('user'); // or whatever location you prefer

I was trying to rely on automated sso setting by removing the cookies, but current function ldap_sso_boot() does not work at all.

2. Modify ldap_sso.module. Looks like IIS sets the variable in form 'DOMAIN\user', not 'user@domain'.

$exploded = explode('\\', $remote_user);
if (count($exploded) == 2) {
  $remote_user = $exploded[1];
}

3. Secure you copy of index.php by removing Anonymous auth from it in web.config

   <location path="index2.php">
          <system.webServer>
             <security>
                    <authentication>
                        <anonymousAuthentication enabled="false" />
                        <windowsAuthentication enabled="true" />
                    </authentication>
             </security>
          </system.webServer>
  </location>

4. Point your browser to your index copy. If you're not logged in to Drupal, it should authenticate you (windows auth) and redirect to user/login/sso, which will do the rest.

It's obviously not the best way but it's working. I couldn't test it without entering windows login/password so far, but I hope it doesnt matter how the needed variable was set.

I'm not familiar with patching etc, but someone could add another ldapImplementation for IIS. The only difference so far is how ssoRemoteUserStripDomainName should work. It would be best to check $remote_user for '@' or '\' and explode it accordingly.

Thanks for the module!

no, 1. is for anon users who want to login (to post or comment), it's the only file/url which requires authentication (windows auth on, anon auth off), main index.php and all the other files are available for everybody as configured in drupal permissions (anon auth on).

It would be great to make 1. in hook_boot alone (or even wouldn't be important in case of non-automatic authentication), but I still don't know how to configure IIS to authenticate on url access instead of file access. We still need IIS to ask user for windows authentication and set the variable. Here's the code (IIS specific, I believe), but I haven't tested it.

if (!isset($_SERVER["REMOTE_USER"]) || $_SERVER["REMOTE_USER"] == '') {
    header('HTTP/1.1 401 Unauthorized');
    header('WWW-Authenticate: Negotiate');
    header('WWW-Authenticate: NTLM', false);
    exit;
} 

Tomorrow I'll try to disable authentication in web.config and use this code instead.

How is this different to just create a folder named 'sso' (which is created in you example) and protect it exactly the same way? What it has to do with Drupal? I really don't understand.

I can confirm that code at #8 works as it should, so there's no need to configure IIS to ask for user credentials.

Pasting this code into ldap_sso.module → ldap_sso_user_login_sso() after if ($enabled == TRUE) will log you in to Drupal or ask for windows password if you navigate to /user/login/sso.

Again, it's tested on IIS7 (both anon and win authentication turned on), PHP 5.2 as FastCGI, I dont have a chance to check if it works on IIS6/php-isapi/etc.

I think custom module with another hook_menu (user/login/iisauth for example) with this code and redirect to user/login/sso will do the trick. Not sure if it's worth to be in ldap_sso, not untill there's a separate "implementation" for IIS.