passport-ntlm v0.3.0
Passport-NTLM
NTLM (a.k.a Windows SSO) authentication strategy for Passport.
This module lets you authenticate HTTP requests using Integrated Windows Authentication in your Node.js applications. Currently it implements only NTLM based authentication. By plugging into Passport, support for this scheme can be easily and unobtrusively integrated into any application or framework that supports Connect-style middleware, including Express.
The authentication mechanism involves the application requesting the credentials of the currently logged in Windows domain user, encrypted using the key obtained from one of the domain controllers and passing it on to the domain controller for validation. In this mechanism the application receives only the encrypted password of the user, encrypted using a key generated by the domain controller, that is valid only for one authentication session with the domain controller.
The module works by obtaining encryption key (session key) from the domain controller and challenging the client browser with the key to receive the encrypted credentials and clear text user name, which is then passed along to the domain controller.
For more information refer to
- Microsoft SMB Protocol and CIFS Protocol Overview https://msdn.microsoft.com/en-us/library/windows/desktop/aa365233(v=vs.85).aspx
- MS-CIFS https://msdn.microsoft.com/en-us/library/ee442092.aspx
- MS-SMB https://msdn.microsoft.com/en-us/library/cc246231.aspx
Install
$ npm install passport-ntlmUsage of NTLM
Configure Strategy
The NTLM authentication strategy authenticates using the credentials
sent by the browser automatically, in response to the NTLM challenge.
The strategy requires an options object and a verify callback. The
options must include one of domainDNS, domain or smbServer,
which will be used to identify the server to validate the credentials.
The verify callback must accept the username and call done
provinding a user.
var NTLMStrategy = require('passport-ntlm').Strategy
passport.use(new NTLMStrategy({domain:'WINDOWSDOMAIN'},
function(username, done) {
var user={ username: username };
return done(null, user);
}
));
Use passport.authenticate(), specifying the 'ntlm' strategy, to
authenticate requests. Since NTLM authentication requests make multiple
exchanges and require the corresponding SMB session to be active till
the authentication is complete session support is needed.
For example, as route middleware in an Express application:
app.get('/private',
passport.authenticate('ntlm', { session: false }),
function(req, res) {
res.json(req.user);
next();
});