You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@httpd.apache.org by Dmitry Butskoy <bu...@odusz.so-cdu.ru> on 2007/07/09 17:26:54 UTC
mod_auth_ntlm_winbind needs hosting
There is a module, "mod_auth_ntlm_winbind", which allows to authenticate
users against a Windows domain using "NTLM" and "Negotiate"
authentication mechanisms. The module uses a way, recommended by the
Samba team -- it utilizes a special helper program "ntlm_auth", which
interacts with Samba's "winbind" daemon. (This way Squid does ntlm already).
For historical reasons, this module still lives in Samba's CVS (see
http://viewcvs.samba.org/cgi-bin/viewcvs.cgi/trunk/mod_auth_ntlm_winbind/?root=lorikeet
) and has no any normal "upstream". This does not mean that the module
is unstable -- it is successfully used long time. Recently it was
included into Debian and Fedora (I maintain it in Fedora, see
http://download.fedora.redhat.com/pub/fedora/linux/updates/7/SRPMS/mod_auth_ntlm_winbind-0.0.0-0.5.20070129svn713.fc7.src.rpm
)
Samba team think that this code is not something Samba-related (see
http://lists.samba.org/archive/samba-technical/2007-June/054186.html).
Actually, it is Apache's httpd-related. Hence it have to be hosted
somewhere in apache.org ...
Any comments?
Moreover, because of its current location, this module lacks good
skilled httpd developers. There can be a lot of things to fix or to
improve on it.
Could anyone look on it carefully?
Regards,
Dmitry Butskoy
http://www.fedoraproject.org/wiki/DmitryButskoy
Re: mod_auth_ntlm_winbind needs hosting
Posted by Dmitry Butskoy <bu...@odusz.so-cdu.ru>.
Dmitry Butskoy wrote:
> There is a module, "mod_auth_ntlm_winbind", which allows to
> authenticate users against a Windows domain using "NTLM" and
> "Negotiate" authentication mechanisms. The module uses a way,
> recommended by the Samba team -- it utilizes a special helper program
> "ntlm_auth", which interacts with Samba's "winbind" daemon. (This way
> Squid does ntlm already).
>
> For historical reasons, this module still lives in Samba's CVS (see
> http://viewcvs.samba.org/cgi-bin/viewcvs.cgi/trunk/mod_auth_ntlm_winbind/?root=lorikeet
> ) and has no any normal "upstream". This does not mean that the module
> is unstable -- it is successfully used long time. Recently it was
> included into Debian and Fedora (I maintain it in Fedora, see
> http://download.fedora.redhat.com/pub/fedora/linux/updates/7/SRPMS/mod_auth_ntlm_winbind-0.0.0-0.5.20070129svn713.fc7.src.rpm
> )
>
>
[snip]
> Moreover, because of its current location, this module lacks good
> skilled httpd developers. There can be a lot of things to fix or to
> improve on it.
>
> Could anyone look on it carefully?
>
Is some progress on it possible in near future?
What I need exactly now is to check the code itself by httpd folk. (The
decision where it should be hosted can be delayed...)
Regards,
Dmitry Butskoy
http://www.fedoraproject.org/wiki/DmitryButskoy
Re: mod_auth_ntlm_winbind needs hosting
Posted by Dmitry Butskoy <bu...@odusz.so-cdu.ru>.
William A. Rowe, Jr. wrote:
> William A. Rowe, Jr. wrote:
>
>> Dmitry Butskoy wrote:
>>
>>> Samba team think that this code is not something Samba-related (see
>>> http://lists.samba.org/archive/samba-technical/2007-June/054186.html).
>>> Actually, it is Apache's httpd-related. Hence it have to be hosted
>>> somewhere in apache.org ...
>>>
>> The issue with hosting at Apache, of course, is that nothing more restrictive
>> than the Apache License (BSD-style) could be applied. Fortunately, the list
>> of authors is rather short, in terms of appealing to them for a grant under
>> the Apache License.
>>
>> Yet and still, there is the minor issue that NTLM violates RFC2616, and as
>> such you might find resistance here :)
>>
>
> Actually, I'm confused :) Knowing Samba is GPL, overall, I'm not clear from
> the file headers that this is, in fact, collected as GPL or continues to be
> Apache Licensed/less restrictive?
>
Certainly, it is Apache Licensed.
Not GPL.
People, who start with this module, surely know about license
compatibility, therefore this module is Apache licensed.
Regards,
Dmitry Butskoy
Re: mod_auth_ntlm_winbind needs hosting
Posted by "William A. Rowe, Jr." <wr...@rowe-clan.net>.
William A. Rowe, Jr. wrote:
> Dmitry Butskoy wrote:
>> Samba team think that this code is not something Samba-related (see
>> http://lists.samba.org/archive/samba-technical/2007-June/054186.html).
>> Actually, it is Apache's httpd-related. Hence it have to be hosted
>> somewhere in apache.org ...
>
> The issue with hosting at Apache, of course, is that nothing more restrictive
> than the Apache License (BSD-style) could be applied. Fortunately, the list
> of authors is rather short, in terms of appealing to them for a grant under
> the Apache License.
>
> Yet and still, there is the minor issue that NTLM violates RFC2616, and as
> such you might find resistance here :)
Actually, I'm confused :) Knowing Samba is GPL, overall, I'm not clear from
the file headers that this is, in fact, collected as GPL or continues to be
Apache Licensed/less restrictive?
c.f.
http://viewcvs.samba.org/cgi-bin/viewcvs.cgi/*checkout*/trunk/mod_auth_ntlm_winbind/mod_auth_ntlm_winbind.c?rev=713&content-type=text%2Fplain&root=lorikeet
Bill
Re: mod_auth_ntlm_winbind needs hosting
Posted by Dmitry Butskoy <bu...@odusz.so-cdu.ru>.
William A. Rowe, Jr. wrote:
> On that note - I suppose this would not be enabled by default, so I have
> a little less concern.
Hmm... I mean to host this module somewhere near the Apache (f.e. at
Apache site), and check it by Apache team. But I feel you think about
inclusion into standard httpd? It is much more than I expect. ;)
~buc
Re: mod_auth_ntlm_winbind needs hosting
Posted by "William A. Rowe, Jr." <wr...@rowe-clan.net>.
Dmitry Butskoy wrote:
> William A. Rowe, Jr. wrote:
>> Yet and still, there is the minor issue that NTLM violates RFC2616,
>> and as
>> such you might find resistance here :)
>>
>
> OTOH, such a module allows to choose a Linux/UNIX server for web or
> proxy, even in "strong" Windows environment (where users must be
> authenticated against a Windows Domain Controller). In other words, to
> choose some open-sourse solution even in such an environment.
I don't disagree :) But as a reference implementation, we hold to the
standards over misbehavior whenever possible, until someone deliberately
breaks the configuration/behavior with respect to the standards.
On that note - I suppose this would not be enabled by default, so I have
a little less concern. One advantage is that we could do the right thing
with respect to proxy agents in front or behind us, when the module is
enabled. Having both the proxy and an implementation of NTLM might be
a win, from that perspective.
Bill
Re: mod_auth_ntlm_winbind needs hosting
Posted by Dmitry Butskoy <bu...@odusz.so-cdu.ru>.
William A. Rowe, Jr. wrote:
> Yet and still, there is the minor issue that NTLM violates RFC2616, and as
> such you might find resistance here :)
>
OTOH, such a module allows to choose a Linux/UNIX server for web or
proxy, even in "strong" Windows environment (where users must be
authenticated against a Windows Domain Controller). In other words, to
choose some open-sourse solution even in such an environment.
~buc
Re: mod_auth_ntlm_winbind needs hosting
Posted by "William A. Rowe, Jr." <wr...@rowe-clan.net>.
Dmitry Butskoy wrote:
>
> Samba team think that this code is not something Samba-related (see
> http://lists.samba.org/archive/samba-technical/2007-June/054186.html).
> Actually, it is Apache's httpd-related. Hence it have to be hosted
> somewhere in apache.org ...
The issue with hosting at Apache, of course, is that nothing more restrictive
than the Apache License (BSD-style) could be applied. Fortunately, the list
of authors is rather short, in terms of appealing to them for a grant under
the Apache License.
Yet and still, there is the minor issue that NTLM violates RFC2616, and as
such you might find resistance here :)
Bill