LDAP SSO: Testing Environments and Results

I have LDAP SSO connecting to a Windows 2008 Active Directory environment on an Apache web server running Perl's AuthenNTLM

We are having quite a bit of success with this config in inside of Apache's VirtualHost section (field in brackets need your environments information):

<VirtualHost *:80>
    ServerName [example.com]
    ServerAdmin [webmaster@example.com]
    DocumentRoot [/path/to/drupal]
        <Directory [/path/to/drupal]>
                AllowOverride All
        </Directory>
  ## Here is the SSO information
  # relative to your drupal site root
  <Location /user/login/sso>
    PerlAuthenHandler Apache2::AuthenNTLM
    AuthType ntlm,basic
    AuthName "Please enter your credentials"
    require valid-user
    #                    domain           pdc                         bdc
    PerlAddVar ntdomain "[Windows domain] [primary_domain_controller] [backup_domain_controller]"

    PerlSetVar defaultdomain [Windows domain]
    PerlSetVar splitdomainprefix 1
    PerlSetVar ntlmdebug 0 #Set to 1 for error log debugging
  </Location>
  ## End SSO info
    ErrorLog [/path/to/error_log]
    CustomLog [/path/to/access_log] common
</VirtualHost>

You have to be careful that you only limit AuthenNTLM to /user/login/sso because it will slowly crash your apache server if it gets too many simultaneous login request. Feel free to ping me with questions.

Using the above conf in my sites-enabled. I am getting an redirect error. my site on load redirects to user/login/sso?destination= with a internal server error.
any thoughts? perl seems to like my conf settings file as the server restarted.

THe LDAP module works as designed SSO is the only piece that is causing a headache!

Thanks for your help in advance!

here is the errors in my log:

[Thu Oct 18 12:32:02 2012] [error] Bad/Missing NTLM/Basic Authorization Header for /user/login/sso
[Thu Oct 18 12:32:02 2012] [error] No PDC and no fallbackdomain given for domain ntdomain
[Thu Oct 18 12:32:02 2012] [error] Cannot get nonce

The best i can tell, is that my ldap server is ntlm v2 and i am trying to pass ntlm v1?

If you are using Windows Vista or above by default IE transmits NTLMv2 unless you use a registry hack to tell it not to. I have been looking into a python version of an apache module to support NTLMv2. https://github.com/Legrandin/PyAuthenNTLM2
I have PyAuthenNTLM2 working in a test environment because we have GoodLink for mobile phones and tablets to connect to our private network which has a proprietary browser that only will send v2 credentials. So far it has worked in my test environment and is pretty simple to set up by following the README file.

Curious! Thanks haydeniv for the tip, we now have ldap auth working in a commandline environment. Its now working correctly once we correctly configured the the vhost file. Thanks! again.

I'm having the same error. How did you fix it?

Thanks.

@jolimas are you using NTLMv1 or v2? Some more information about your setup would be helpful.
Operating System Version
Apache Version
Current virtualhost config (sensor any sensitive data)
PHP Version

Haydeniv,

I end up using the https://github.com/Legrandin/PyAuthenNTLM2, and now every works fine.

Thanks.

Review in regards to 8