Hi, We tried to solve this a couple of ways, and using the LDAP plugin proved to be quite fiddly (maybe I just don't get on with X500...). We used to use IIS, but switched to Apache, then moved the servers to linux - found the subjective "responsiveness" was better on LAMPP than windows. We ended up plumping for: http://meta.wikimedia.org/wiki/User:Otheus/Auto_Login_via_REMOTE_USER ... and tweaking it. Its a much simpler extension, that merely creates users on demand, assuming the server has authenticated them correctly, and doesn't rely on much other than server config (I think there may be some issues with cases to resolve). With permissions set right on the sub folder, everything should work fine. We ended up moving to mysql authentication via auth_mysql, and keeping separate user lists, but little needed to change. Hope that helps, Alex On 9/18/07, Connolly, Wayne <Wayne.Connolly(a)team.telstra.com> wrote: -- Alex Powell Exscien Training Ltd Tel: +44 (0) 1865 920024 Direct: +44 (0) 1865 920032 Mob: +44 (0) 7717 765210 skype: alexp700 mailto:alexp@exscien.com http://www.exscien.com Registered in England and Wales 05927635, Unit 10 Wheatley Business Park, Old London Road, Wheatley, OX33 1XW, England

On 9/18/07, Connolly, Wayne <Wayne.Connolly(a)team.telstra.com> wrote: Hi Wayne, Theres a PHP extension called Plexcel that does Windows authentication and much much more. It doesn't use NTLM though. It uses Kerberos and something called SPNEGO. This is actually what IIS is doing when you turn on IWA. On the wire, Plexcel is just like IWA. If you want NTLM I think theres a module for Apache that can call Samba's Winbind daemon. But note that NTLM is not optimal for this scenario. It requires communication with a domain controller whereas Kerberos does not (although NTLM is still required for scenarios where the client is not a member of the domain or a member of a domain that has a trust with the target domain). Anyway, I guess I'm starting to rant. In addition to the Plexcel extension there's a little MediaWiki plugin that calls plexcel. Check it out: http://www.ioplex.com/mediawiki_plugin.html It handles SSO, explicit login using the conventional form, automatically creates accounts in the local DB with the user's info from AD and has ACLs to control who can access content and such. Bear in mind that you're going to need a MediaWiki plugin so that the user's information can be pushed into MW so that the higher level logic does sensible things. You can't just use mod_ntlm or flip on IWA in IIS. Mike -- Michael B Allen PHP Active Directory Kerberos SSO http://www.ioplex.com/