Drupal Answers is a question and answer site for Drupal developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to install Drupal with Single Sign On over Active Directory.

My customer does not have any SSO suite like CAS, and their general recommendation are to use Kerberos (or NTLM as a second choice). I am clearly agreed with that.

Each time I had to integrate SSO with Active Directory using Kerberos, I use "native" product facilities, or apache mod_auth_kerb with headers rewrite.

Does someone implemented such a working module ? Everything I read about that is around "on developpement modules" on "snapshots realeases". We are currently using a ldap module that allow authentication over LDAP, and it seems that it provide SSO features, but I don't have any feedback on it.

So : Should I implements SSO over Kerberos using Apache mod_auth_kerb, or is there a real functional module that would encapsulate all those tedious configuration and dialog ?

What is the best pratice, at this moment ? Could you provide me "real" (anonymised) examples ?

As soon as I would installed it and put in in production (around the end of december), i would give you my feedback.

Thanks in advance

share|improve this question
up vote 1 down vote accepted

After some researches and tests, I finally made a choice.

In most cases, I'd prefer use native or add on features. This provide better integreation with the product (here Drupal) and it's more a Logic solution than a technical one (which is quite easier). The LDAP_SSO module allow this kind of configuration.

Nevertheless, I was not able to configure it this time, mainly due to poor debug facilities. Even with watchdog, I am not able to know what is the matter. Moreover, my customer have clear procedure to install and use Kerberos, with Apache HTTP and mod_auth_kerb. Hopefully, LDAP_SSO module allow this too.

After some tries, I will get back here to share with you more advanced comments, but at this time, we clearly go to apache+mod_auth_kerb+fowarded REMOTE_USER.

Edit a few monthes later :

That works great with Mod auth kerb on apache server and ldap module v1.0-beta12 on drupal. Even if v2.0 is available, we were facing some issues because some fields were empty and this were causing troubleshootings. But nevermind, we are able to authenticate et identify users, collect groups and map them to drupal profiles etc.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.