I am currently using the Secure Site HTML log-in form and LDAP auth as my primary form of authentication.
Alternatively, I have a link to attempt NTLM auto log-in through a script using mod_auth_sspi Apache module and the code below inside the root of Drupal.

My Apache security directive is only set for this script 'autologin.php' and does not affect any other section of the site.

  • Once logged in through the auto log-in script and logging out I cannot use the Secure Site HTML log-in form without closing the browser and/or clearing the session/cookie data - login attempts just show the form again as if I refreshed the page.
  • When logged in through the NTLM auto log-in script, I cannot use filefield or imagefield. I get an unknown error on screen that suggests I may have reached my maximum upload size

I notice these issues more or less frequently depending on which browser I am using, Internet Explorer being the worse.

Can anyone please shed light on these issues in my scenario?

autologin.php:

require_once 'includes/bootstrap.inc';
drupal_bootstrap(DRUPAL_BOOTSTRAP_FULL); 
$authname = '';
  //mod_auth_sspi 
  if (isset($_SERVER['REDIRECT_REMOTE_USER'])) {
    $authname = $_SERVER['REDIRECT_REMOTE_USER'];
  }
  elseif (isset($_SERVER['REMOTE_USER'])) {
    $authname = $_SERVER['REMOTE_USER'];
  }
  $authname = array_pop(explode("\\", $authname));

if($authname && function_exists("user_load")){
  $result = db_query("SELECT uid FROM {authmap} WHERE authname = '%s' AND module = 'ldapauth'", $authname);
  $expected = db_fetch_array($result);
    if ($account = user_load(array('uid' => $expected['uid'], 'status' => 1))) {
      global $user;
      $user = $account;

      watchdog('user', 'Session opened for %name.', array('%name' => $user->name));
      db_query("UPDATE {users} SET login = %d WHERE uid = %d", time(), $user->uid);
      sess_regenerate();

    unset($_SESSION['securesite_denied']);
    unset($_SESSION['messages']);
    unset($_SESSION['securesite_guest']);
    $_SESSION['securesite_login'] = TRUE;
    //redirect
    drupal_goto("user");
    }
}