Hello to all. I want to make auto login to GLPI via AD by means of NTLM. But that's not working. NTLM authorization, as I understand it, works but incorrectly. When entering GLPI, the system authorizes, but all the time the login and password entry window pops up. Tried to enter user login password - does not help. What is the problem, I do not understand. I searched the text of errors in the apache2 server logs, but did not come to a common opinion how to solve this problem. I tried to run a php script that checks NTLM authentication, it seems to determine everything correctly. Maybe I'm doing something wrong? Here is the script:

<?php /*********************************************************************** * PHP NTLM GET LOGIN * Version 0.2 * ==================================================== * * Copyright (c) 2004 Nicolas GOLLET (Nicolas.gollet@secusquad.com) * Copyright (c) 2004 Flextronics Saint-Etienne * * This program is free software. You can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 2 of the License. * ***********************************************************************/ /* L'identification par NTLM se fait en 6 etape : etape: | type: | Info echange -------|----------------|-------------------------------------------------- 1 | C --> S | GET ... legende : C = Client -------|----------------|-------------------------------------------------- S = Serveur 2 | C <-- S | 401 Unauthorized | | WWW-Authenticate: NTLM -------|----------------|-------------------------------------------------- 3 | C --> S | GET ... | | Authorization: NTLM <base64-encoded type-1-message> -------|----------------|-------------------------------------------------- 4 | C <-- S | 401 Unauthorized | | WWW-Authenticate: NTLM <base64-encoded type-2-message> -------|----------------|-------------------------------------------------- 5 | C --> S | GET ... | | Authorization: NTLM <base64-encoded type-3-message> -------|----------------|-------------------------------------------------- 6 | C <-- S | 200 Ok -------|----------------|-------------------------------------------------- */ $headers = apache_request_headers(); // Recuperation des l'entetes client if($headers['Authorization'] == NULL){ //si l'entete autorisation est inexistante header( "HTTP/1.0 401 Unauthorized" ); //envoi au client le mode d'identification header( "WWW-Authenticate: NTLM" ); //dans notre cas le NTLM exit; //on quitte }; if(isset($headers['Authorization'])) //dans le cas d'une authorisation (identification) { if(substr($headers['Authorization'],0,5) == 'NTLM '){ // on verifit que le client soit en NTLM $chaine=$headers['Authorization']; $chaine=substr($chaine, 5); // recuperation du base64-encoded type1 message $chained64=base64_decode($chaine); // decodage base64 dans $chained64 if(ord($chained64{8}) == 1){ // |_ byte signifiant l'etape du processus d'identification (etape 3) // verification du drapeau NTLM "0xb2" a l'offset 13 dans le message type-1-message : if (ord($chained64[13]) != 178){ echo "Votre navigateur Internet n'est pas compatible avec le NTLM, utiliser IE...Merci"; exit; } $retAuth = "NTLMSSP"; $retAuth .= chr(0); $retAuth .= chr(2); $retAuth .= chr(0); $retAuth .= chr(0); $retAuth .= chr(0); $retAuth .= chr(0); $retAuth .= chr(0); $retAuth .= chr(0); $retAuth .= chr(0); $retAuth .= chr(40); $retAuth .= chr(0); $retAuth .= chr(0); $retAuth .= chr(0); $retAuth .= chr(1); $retAuth .= chr(130); $retAuth .= chr(0); $retAuth .= chr(0); $retAuth .= chr(0); $retAuth .= chr(2); $retAuth .= chr(2); $retAuth .= chr(2); $retAuth .= chr(0); $retAuth .= chr(0); $retAuth .= chr(0); $retAuth .= chr(0); $retAuth .= chr(0); $retAuth .= chr(0); $retAuth .= chr(0); $retAuth .= chr(0); $retAuth .= chr(0); $retAuth .= chr(0); $retAuth .= chr(0); $retAuth .= chr(0); $retAuth64 =base64_encode($retAuth); // encode en base64 $retAuth64 = trim($retAuth64); // enleve les espaces de debut et de fin header( "HTTP/1.0 401 Unauthorized" ); // envoi le nouveau header header( "WWW-Authenticate: NTLM $retAuth64" ); // avec l'identification supplementaire exit; } else if(ord($chained64{8}) == 3){ // |_ byte signifiant l'etape du processus d'identification (etape 5) // on recupere le domaine $lenght_domain = (ord($chained64[31])*256 + ord($chained64[30])); // longueur du domain $offset_domain = (ord($chained64[33])*256 + ord($chained64[32])); // position du domain. $domain = substr($chained64, $offset_domain, $lenght_domain); // decoupage du du domain //le login $lenght_login = (ord($chained64[39])*256 + ord($chained64[38])); // longueur du login. $offset_login = (ord($chained64[41])*256 + ord($chained64[40])); // position du login. $login = substr($chained64, $offset_login, $lenght_login); // decoupage du login // l'host $lenght_host = (ord($chained64[47])*256 + ord($chained64[46])); // longueur de l'host. $offset_host = (ord($chained64[49])*256 + ord($chained64[48])); // position de l'host. $host = substr($chained64, $offset_host, $lenght_host); // decoupage du l'host echo "Domain is : $domain"; echo "<br>Login is : $login"; echo "<br>host is : $host"; } } } ?>

The script shows the login, machine name and domain. The configuration is as follows:

 <Directory "/var/www/glpi/"> AuthName NTAuth AuthType NTLM NTLMAuth on NTLMAuthoritative on NTLMDomain garant-servis.ru NTLMServer srv NTLMBackup srv require valid-user Satisfy all Allow from all NTLMLockfile /tmp/ntlmauth.lck </Directory>

Apache2 error message:

 [Wed Aug 08 17:33:40 2012] [error] [client 192.168.0.231] 578157960 1999 /glpi/script.js - NTLM/SMB user "(null)": authentication failure for "/glpi/script.js", referer: http://192.168.0.73/glpi/front/central.php [Wed Aug 08 17:33:40 2012] [error] 1389 - SMB_Logon_Server: Error sending SessSetupX request [Wed Aug 08 17:33:40 2012] [error] [client 192.168.0.231] 578157960 1389 /glpi/lib/extjs/ext-all.js - NTLM/SMB user "(null)": authentication failure for "/glpi/lib/extjs/ext-all.js", referer: http://192.168.0.73/glpi/front/central.php [Wed Aug 08 17:33:40 2012] [error] [client 192.168.0.231] 578157960 1390 /glpi/lib/extrajs/xdatefield.js - send_ntlm_challenge: no conn. handle...trouble communicating with PDC/BDC? returning internal server error, referer: http://192.168.0.73/glpi/front/central.php [Wed Aug 08 17:33:40 2012] [error] 1389 - SMB_Logon_Server: Error sending SessSetupX request [Wed Aug 08 17:33:40 2012] [error] [client 192.168.0.231] 578157960 1389 /glpi/lib/extrajs/starslider/slider.js - NTLM/SMB user "(null)": authentication failure for "/glpi/lib/extrajs/starslider/slider.js", referer: http://192.168.0.73/glpi/front/central.php [Wed Aug 08 17:33:40 2012] [error] 1999 - SMB_Logon_Server: Error sending SessSetupX request [Wed Aug 08 17:33:40 2012] [error] [client 192.168.0.231] 578157960 1999 /glpi/lib/extrajs/starslider/slider.css - NTLM/SMB user "(null)": authentication failure for "/glpi/lib/extrajs/starslider/slider.css", referer: http://192.168.0.73/glpi/front/central.php [Wed Aug 08 17:33:40 2012] [error] 1386 - SMB_Logon_Server: Error sending SessSetupX request [Wed Aug 08 17:33:40 2012] [error] [client 192.168.0.231] 578157960 1386 /glpi/lib/extrajs/datetime.js - NTLM/SMB user "(null)": authentication failure for "/glpi/lib/extrajs/datetime.js", referer: http://192.168.0.73/glpi/front/central.php [Wed Aug 08 17:33:44 2012] [error] 1386 - SMB_Logon_Server: Error sending SessSetupX request [Wed Aug 08 17:33:44 2012] [error] [client 192.168.0.231] 578157960 1386 /glpi/pics/fd_nav1.png - NTLM/SMB user "(null)": authentication failure for "/glpi/pics/fd_nav1.png", referer: http://192.168.0.73/glpi/front/central.php [Wed Aug 08 17:33:44 2012] [error] 2040 - SMB_Logon_Server: Error sending SessSetupX request [Wed Aug 08 17:33:44 2012] [error] [client 192.168.0.231] 578157960 2040 /glpi/pics/ok2.png - NTLM/SMB user "(null)": authentication failure for "/glpi/pics/ok2.png", referer: http://192.168.0.73/glpi/front/central.php [Wed Aug 08 17:33:44 2012] [error] 1999 - SMB_Logon_Server: Error sending SessSetupX request [Wed Aug 08 17:33:44 2012] [error] [client 192.168.0.231] 578157960 1999 /glpi/pics/fd_ssmenu.png - NTLM/SMB user "(null)": authentication failure for "/glpi/pics/fd_ssmenu.png", referer: http://192.168.0.73/glpi/front/central.php [Wed Aug 08 17:33:44 2012] [error] 1389 - SMB_Logon_Server: Error sending SessSetupX request [Wed Aug 08 17:33:44 2012] [error] [client 192.168.0.231] 578157960 1389 /glpi/pics/fd_hoverlink.png - NTLM/SMB user "(null)": authentication failure for "/glpi/pics/fd_hoverlink.png", referer: http://192.168.0.73/glpi/front/central.php [Wed Aug 08 17:33:44 2012] [error] 2040 - SMB_Logon_Server: Error sending SessSetupX request [Wed Aug 08 17:33:44 2012] [error] [client 192.168.0.231] 578157960 2040 /glpi/pics/fd_nav3.png - NTLM/SMB user "(null)": authentication failure for "/glpi/pics/fd_nav3.png", referer: http://192.168.0.73/glpi/front/central.php [Wed Aug 08 17:33:44 2012] [error] 1386 - SMB_Logon_Server: Error sending SessSetupX request [Wed Aug 08 17:33:44 2012] [error] [client 192.168.0.231] 578157960 1386 /glpi/pics/bookmark.png - NTLM/SMB user "(null)": authentication failure for "/glpi/pics/bookmark.png", referer: http://192.168.0.73/glpi/front/central.php [Wed Aug 08 17:33:44 2012] [error] 1999 - SMB_Logon_Server: Error sending SessSetupX request [Wed Aug 08 17:33:44 2012] [error] [client 192.168.0.231] 578157960 1999 /glpi/pics/fd_footer.png - NTLM/SMB user "(null)": authentication failure for "/glpi/pics/fd_footer.png", referer: http://192.168.0.73/glpi/front/central.php [Wed Aug 08 17:33:44 2012] [error] 1389 - SMB_Logon_Server: Error sending SessSetupX request [Wed Aug 08 17:33:44 2012] [error] [client 192.168.0.231] 578157960 1389 /glpi/pics/fd_logo.png - NTLM/SMB user "(null)": authentication failure for "/glpi/pics/fd_logo.png", referer: http://192.168.0.73/glpi/front/central.php [Wed Aug 08 17:33:44 2012] [error] 2000 - SMB_Logon_Server: Error sending SessSetupX request [Wed Aug 08 17:33:44 2012] [error] [client 192.168.0.231] 578157960 2000 /glpi/pics/fd_nav2.png - NTLM/SMB user "(null)": authentication failure for "/glpi/pics/fd_nav2.png", referer: http://192.168.0.73/glpi/front/central.php [Wed Aug 08 17:33:53 2012] [error] 1386 - SMB_Logon_Server: Error sending SessSetupX request [Wed Aug 08 17:33:53 2012] [error] [client 192.168.0.231] 578157960 1386 /glpi/css/styles.css - NTLM/SMB user "(null)": authentication failure for "/glpi/css/styles.css", referer: http://192.168.0.73/glpi/front/central.php [Wed Aug 08 17:33:54 2012] [error] 1999 - SMB_Logon_Server: Error sending SessSetupX request [Wed Aug 08 17:33:54 2012] [error] [client 192.168.0.231] 578157960 1999 /glpi/css/styles.css - NTLM/SMB user "(null)": authentication failure for "/glpi/css/styles.css", referer: http://192.168.0.73/glpi/front/central.php [Wed Aug 08 17:33:54 2012] [error] 1386 - SMB_Logon_Server: Error sending SessSetupX request [Wed Aug 08 17:33:54 2012] [error] [client 192.168.0.231] 578157960 1386 /glpi/css/print.css - NTLM/SMB user "(null)": authentication failure for "/glpi/css/print.css", referer: http://192.168.0.73/glpi/front/central.php [Wed Aug 08 17:33:54 2012] [error] 2040 - SMB_Logon_Server: Error sending SessSetupX request [Wed Aug 08 17:33:54 2012] [error] [client 192.168.0.231] 578157960 2040 /glpi/lib/tiny_mce/tiny_mce.js - NTLM/SMB user "(null)": authentication failure for "/glpi/lib/tiny_mce/tiny_mce.js", referer: http://192.168.0.73/glpi/front/central.php [Wed Aug 08 17:33:54 2012] [error] 1386 - SMB_Logon_Server: Error sending SessSetupX request [Wed Aug 08 17:33:54 2012] [error] [client 192.168.0.231] 578157960 1386 /glpi/lib/extjs/resources/css/ext-all.css - NTLM/SMB user "(null)": authentication failure for "/glpi/lib/extjs/resources/css/ext-all.css", referer: http://192.168.0.73/glpi/front/central.php [Wed Aug 08 17:33:54 2012] [error] 1999 - SMB_Logon_Server: Error sending SessSetupX request [Wed Aug 08 17:33:54 2012] [error] [client 192.168.0.231] 578157960 1999 /glpi/lib/extrajs/starslider/slider.css - NTLM/SMB user "(null)": authentication failure for "/glpi/lib/extrajs/starslider/slider.css", referer: http://192.168.0.73/glpi/front/central.php [Wed Aug 08 17:33:54 2012] [error] 2040 - SMB_Logon_Server: Error sending SessSetupX request [Wed Aug 08 17:33:54 2012] [error] [client 192.168.0.231] 578157960 2040 /glpi/css/ext-all-glpi.css - NTLM/SMB user "(null)": authentication failure for "/glpi/css/ext-all-glpi.css", referer: http://192.168.0.73/glpi/front/central.php [Wed Aug 08 17:33:54 2012] [error] 1389 - SMB_Logon_Server: Error sending SessSetupX request [Wed Aug 08 17:33:54 2012] [error] [client 192.168.0.231] 578157960 1389 /glpi/lib/extjs/locale/ext-lang-ru.js - NTLM/SMB user "(null)": authentication failure for "/glpi/lib/extjs/locale/ext-lang-ru.js", referer: http://192.168.0.73/glpi/front/central.php [Wed Aug 08 17:33:54 2012] [error] 2000 - SMB_Logon_Server: Error sending SessSetupX request [Wed Aug 08 17:33:54 2012] [error] [client 192.168.0.231] 578157960 2000 /glpi/lib/extrajs/xdatefield.js - NTLM/SMB user "(null)": authentication failure for "/glpi/lib/extrajs/xdatefield.js", referer: http://192.168.0.73/glpi/front/central.php [Wed Aug 08 17:33:54 2012] [error] 1999 - SMB_Logon_Server: Error sending SessSetupX request [Wed Aug 08 17:33:54 2012] [error] [client 192.168.0.231] 578157960 1999 /glpi/lib/extrajs/spancombobox.js - NTLM/SMB user "(null)": authentication failure for "/glpi/lib/extrajs/spancombobox.js", referer: http://192.168.0.73/glpi/front/central.php [Wed Aug 08 17:33:54 2012] [error] 2040 - SMB_Logon_Server: Error sending SessSetupX request [Wed Aug 08 17:33:54 2012] [error] [client 192.168.0.231] 578157960 2040 /glpi/lib/extrajs/datetime.js - NTLM/SMB user "(null)": authentication failure for "/glpi/lib/extrajs/datetime.js", referer: http://192.168.0.73/glpi/front/central.php [Wed Aug 08 17:33:54 2012] [error] 1386 - SMB_Logon_Server: Error sending SessSetupX request [Wed Aug 08 17:33:54 2012] [error] [client 192.168.0.231] 578157960 1386 /glpi/lib/extrajs/starslider/slider.js - NTLM/SMB user "(null)": authentication failure for "/glpi/lib/extrajs/starslider/slider.js", referer: http://192.168.0.73/glpi/front/central.php [Wed Aug 08 17:33:54 2012] [error] 1389 - SMB_Logon_Server: Error sending SessSetupX request [Wed Aug 08 17:33:54 2012] [error] [client 192.168.0.231] 578157960 1389 /glpi/lib/extjs/ext-all.js - NTLM/SMB user "(null)": authentication failure for "/glpi/lib/extjs/ext-all.js", referer: http://192.168.0.73/glpi/front/central.php [Wed Aug 08 17:33:54 2012] [error] 1386 - SMB_Logon_Server: Error sending SessSetupX request [Wed Aug 08 17:33:54 2012] [error] [client 192.168.0.231] 578157960 1386 /glpi/css/tab-scroller-menu.css - NTLM/SMB user "(null)": authentication failure for "/glpi/css/tab-scroller-menu.css", referer: http://192.168.0.73/glpi/front/central.php [Wed Aug 08 17:33:54 2012] [error] 2000 - SMB_Logon_Server: Error sending SessSetupX request [Wed Aug 08 17:33:54 2012] [error] [client 192.168.0.231] 578157960 2000 /glpi/lib/extrajs/TabScrollerMenu.js - NTLM/SMB user "(null)": authentication failure for "/glpi/lib/extrajs/TabScrollerMenu.js", referer: http://192.168.0.73/glpi/front/central.php [Wed Aug 08 17:33:54 2012] [error] 1999 - SMB_Logon_Server: Error sending SessSetupX request [Wed Aug 08 17:33:54 2012] [error] [client 192.168.0.231] 578157960 1999 /glpi/script.js - NTLM/SMB user "(null)": authentication failure for "/glpi/script.js", referer: http://192.168.0.73/glpi/front/central.php [Wed Aug 08 17:33:55 2012] [error] 2173 - SMB_Logon_Server: SMB_SessSetupAndX failed; errorclass = 1, Error Code = 5\n [Wed Aug 08 17:33:55 2012] [error] [client 192.168.0.231] 578157960 2173 /glpi/lib/extjs/adapter/ext/ext-base.js - NTLM/SMB user "(null)": authentication failure for "/glpi/lib/extjs/adapter/ext/ext-base.js", referer: http://192.168.0.73/glpi/front/central.php [Wed Aug 08 17:33:58 2012] [error] 1389 - SMB_Logon_Server: Error sending SessSetupX request [Wed Aug 08 17:33:58 2012] [error] [client 192.168.0.231] 578157960 1389 /glpi/pics/ok2.png - NTLM/SMB user "(null)": authentication failure for "/glpi/pics/ok2.png", referer: http://192.168.0.73/glpi/front/central.php [Wed Aug 08 17:33:58 2012] [error] 1999 - SMB_Logon_Server: Error sending SessSetupX request [Wed Aug 08 17:33:58 2012] [error] [client 192.168.0.231] 578157960 1999 /glpi/pics/bookmark.png - NTLM/SMB user "(null)": authentication failure for "/glpi/pics/bookmark.png", referer: http://192.168.0.73/glpi/front/central.php [Wed Aug 08 17:33:58 2012] [error] 2173 - SMB_Logon_Server: SMB_SessSetupAndX failed; errorclass = 1, Error Code = 5\n [Wed Aug 08 17:33:58 2012] [error] [client 192.168.0.231] 578157960 2173 /glpi/pics/menu_all.png - NTLM/SMB user "(null)": authentication failure for "/glpi/pics/menu_all.png", referer: http://192.168.0.73/glpi/front/central.php [Wed Aug 08 17:34:03 2012] [error] 2000 - SMB_Logon_Server: Error sending SessSetupX request [Wed Aug 08 17:34:03 2012] [error] [client 192.168.0.231] 578157960 2000 /glpi/ - NTLM/SMB user "(null)": authentication failure for "/glpi/" [Wed Aug 08 17:34:07 2012] [error] 1386 - SMB_Logon_Server: Error sending SessSetupX request [Wed Aug 08 17:34:07 2012] [error] [client 192.168.0.231] 578157960 1386 /glpi/test1.php - NTLM/SMB user "(null)": authentication failure for "/glpi/test1.php" [Wed Aug 08 17:34:10 2012] [error] 2173 - SMB_Logon_Server: SMB_SessSetupAndX failed; errorclass = 1, Error Code = 5\n [Wed Aug 08 17:34:10 2012] [error] [client 192.168.0.231] 578157960 2173 /glpi/test1.php - NTLM/SMB user "(null)": authentication failure for "/glpi/test1.php" [Wed Aug 08 17:34:11 2012] [error] 2040 - SMB_Logon_Server: Error sending SessSetupX request [Wed Aug 08 17:34:11 2012] [error] [client 192.168.0.231] 578157960 2040 /glpi/test1.php - NTLM/SMB user "(null)": authentication failure for "/glpi/test1.php" [Wed Aug 08 17:35:09 2012] [error] 1388 - SMB_Logon_Server: SMB_SessSetupAndX failed; errorclass = 1, Error Code = 5\n [Wed Aug 08 17:35:09 2012] [error] [client 192.168.0.231] 578157960 1388 /glpi/ - NTLM/SMB user "(null)": authentication failure for "/glpi/" [Wed Aug 08 17:37:53 2012] [error] 1387 - SMB_Logon_Server: SMB_SessSetupAndX failed; errorclass = 1, Error Code = 5\n [Wed Aug 08 17:37:53 2012] [error] [client 192.168.0.233] 578157960 1387 /glpi/pics/fd_footer.png - NTLM/SMB user "(null)": authentication failure for "/glpi/pics/fd_footer.png", referer: http://192.168.0.73/glpi/front/central.php [Wed Aug 08 17:38:46 2012] [error] 1390 - SMB_Logon_Server: SMB_SessSetupAndX failed; errorclass = 1, Error Code = 5\n [Wed Aug 08 17:38:46 2012] [error] [client 192.168.0.231] 578157960 1390 /glpi/ - NTLM/SMB user "(null)": authentication failure for "/glpi/" [Wed Aug 08 17:38:49 2012] [error] 1390 - SMB_Logon_Server: SMB_SessSetupAndX failed; errorclass = 1, Error Code = 5\n [Wed Aug 08 17:38:49 2012] [error] [client 192.168.0.231] 578157960 1390 /glpi/ - NTLM/SMB user "(null)": authentication failure for "/glpi/" [Wed Aug 08 17:38:50 2012] [error] 1390 - SMB_Logon_Server: SMB_SessSetupAndX failed; errorclass = 1, Error Code = 5\n [Wed Aug 08 17:38:50 2012] [error] [client 192.168.0.231] 578157960 1390 /glpi/ - NTLM/SMB user "(null)": authentication failure for "/glpi/" [Wed Aug 08 17:38:50 2012] [error] 1390 - SMB_Logon_Server: SMB_SessSetupAndX failed; errorclass = 1, Error Code = 5\n [Wed Aug 08 17:38:50 2012] [error] [client 192.168.0.231] 578157960 1390 /glpi/ - NTLM/SMB user "(null)": authentication failure for "/glpi/"

uname -a

 Linux ocsinventory-ng 2.6.32-38-generic #83-Ubuntu SMP Wed Jan 4 11:13:04 UTC 2012 i686 GNU/Linux

Configured with http://www.z4blog.ru/2011/10/prozrachnaya-avtorizaciya-v-glpi/

and http://www.glpi-project.org/wiki/doku.php?id=en:authautoad

    1 answer 1

    problem with SMB_Logon_Server:

    SMB_SessSetupAndX failed; errorclass = 1, Error Code = 5

    no one seems to have investigated. And it turns out that it is connected to the fact that ntlm.c:ntlm_check_response() (line approximately 600) has a check (that is, the user is already authenticated and there is no need to contact the server anymore):

     if (ntlm_connection->auth_ok && ntlm_connection->user) { /* user has already valid credentials */ if ((!strcmp(ntlm_connection->user, ntlmssp->user)) && (!strcmp(ntlm_connection->domain, ntlmssp->domain)) && (!memcmp(ntlm_connection->password, ntlmssp->nt, RESP_LEN))) { log(r, APLOG_INFO, “silent reauthentication”); /* silently accept login with same credentials */ r->user = apr_pstrdup(r->connection->pool, ntlm_connection->user); r->ap_auth_type = apr_pstrdup(r->connection->pool, NTLM_AUTH_NAME); return OK; }

    In (!memcmp(ntlm_connection->password, ntlmssp->nt, RESP_LEN)) password and nt contain different values. As workaround, I commented out this password match check. After that, everything became good.

    Mb Someone will see why the password is spoiled. I am lazy because from NTLM you need only the name of the user who visits the site, and authorization is done by local means :).