How to integrate properly Kerberos based SSO in Drupal 7

Question

I'm trying to install Drupal with Single Sign On over Active Directory.

My customer does not have any SSO suite like CAS, and their general recommendation are to use Kerberos (or NTLM as a second choice). I am clearly agreed with that.

Each time I had to integrate SSO with Active Directory using Kerberos, I use "native" product facilities, or apache mod_auth_kerb with headers rewrite.

Does someone implemented such a working module ? Everything I read about that is around "on developpement modules" on "snapshots realeases". We are currently using a ldap module that allow authentication over LDAP, and it seems that it provide SSO features, but I don't have any feedback on it.

So : Should I implements SSO over Kerberos using Apache mod_auth_kerb, or is there a real functional module that would encapsulate all those tedious configuration and dialog ?

What is the best pratice, at this moment ? Could you provide me "real" (anonymised) examples ?

As soon as I would installed it and put in in production (around the end of december), i would give you my feedback.

Thanks in advance

Answer 1

After some researches and tests, I finally made a choice.

In most cases, I'd prefer use native or add on features. This provide better integreation with the product (here Drupal) and it's more a Logic solution than a technical one (which is quite easier). The LDAP_SSO module allow this kind of configuration.

Nevertheless, I was not able to configure it this time, mainly due to poor debug facilities. Even with watchdog, I am not able to know what is the matter. Moreover, my customer have clear procedure to install and use Kerberos, with Apache HTTP and mod_auth_kerb. Hopefully, LDAP_SSO module allow this too.

After some tries, I will get back here to share with you more advanced comments, but at this time, we clearly go to apache+mod_auth_kerb+fowarded REMOTE_USER.