The NTLM (NT LAN Manager) connector provides single sign-on (SSO) functionality for Windows systems within a trusted domain environment. The connector utilizes the Windows challenge/response authentication protocol to retrieve credentials from the Windows operating system and uses those credentials to log into Magnolia's CMS.
NTLM Connector is a Enterprise Edition module. You can download the module from our Nexus repository
The LDAP connector must be installed and the AD (Active Directory) connection should be verified to be working before proceeding with installing this module. The LDAP connector must be configured to connect to the host Windows system's domain controller and set to resolve users and groups from AD.
Optionally you can write your own
ADRoleResolver and resolve also roles from AD. Your
ADRoleResolver should implement the
To configure the module:
- Stop the application server(s) where you are deploying the module.
- Copy the
magnolia-module-ntlmJAR file into the WEB-INF/lib directory in the webapp:
- Copy the jaas.policy file into the
- Enable SSO authentication via Tomcat:
- Copy the provided context.xml into
- Copy all JARs in the bundle - with the exception of the magnolia-module-ntlm JAR and the appropriate waffle-tomcat* JAR, to
CATALINA_HOME/lib. (Note: If you using Tomcat 6 you need use
waffle-tomcat6JAR; if Tomcat 7 then
waffle-tomcat7JAR. If you using a different version of Tomcat, see https://oss.sonatype.org)/content/repositories/releases/com/github/dblock/waffle/
- Copy all slf4j and commons-logging wrapper JARs to
CATALINA_HOME/lib. Note: These JARs (slf4j-log4j12, slf4j-api and jcl-over-slf4j) are located in the Tomcat installation directory in
magnoliaPublic/WEB-INFin Magnolia Enterprise Edition.
- Copy the provided context.xml into
- Set ssoSlave = true in your
ad.propertiesis contained within the LDAP connector bundle and is typically in the directory WEB-INF/config/ldap.)
Append the following code to
Restart all instances. If
context.xmlis removed after starting the instance, Tomcat needs to be forced to redeploy the application by removing all references from
While this module logs in directly instead of going through JAAS, it does so by utilizing the Waffle Windows Authentication Framework. Waffle utilizes JAAS resulting in the need for the JAAS installation steps. Waffle's Servlet Negotiate Security Filter from the Waffle Framework was used for the implementation. This module works in connection with the LDAP connector module's AD authentication. Once SSO is enabled, only user accounts that exist in AD can be used to log into Magnolia. For this reason, there must be accounts with administrator rights in addition to the provided superuser account that exist in AD. Once installation is completed, NTLM will appear as a login filter in AdminCentral.
Add the login handler:
Adding the waffle filter:
NTLM client callback:
Adding external user manager:
When SSO authentication is enabled to occur via Tomcat as described in the configuration, waffle will delegate the NTLM authentication to Tomcat. Tomcat performs server wide authentication in which all web applications on the instance share the authentication. When SSO authentication does not occur via Tomcat, the waffle authentication is utilized only by the Magnolia web application and is valid only within the Magnolia web container.
To avoid logged in users bypassing password requirement and changing identity:
info.magnolia.jaas.sp.ldap.ADAuthenticationModulejaasinto separate jaas login chains. For example, add
magnolia-ntlm. Then change your jaas.config to:
- This module can only be used on a Windows operating system server with a domain controller. This requirement excludes the ability to use this module on Vista.
- SSO when enabled is enabled for all users in all realms.
- Some versions of Tomcat have issues with unloading native connectors used to perform the actual NTLM authentication operations. When this occurs you can see an exception explaining the problem on shutdown and you need to kill the Tomcat process manually.
- NTLM authentication is not supported for all browsers. Native support exists for IE only. Safari, Chrome and Firefox allow users to enter their Windows username and password while some other browsers such as Opera do not allow login.
- While the installation is reported to be working fine with older versions of Windows Server, Windows Server 2008 configuration is certified and tested by Magnolia.
- When SSO is enabled on the author instance, activation works only via workflow.
- For security reasons SSO is recommended only for author instances, not for public instances. It is common practice not to expose Active Directory services to the Internet. In a controlled intranet environment it is OK to use SSO on a public instance but not on a public website.
- IE incorrectly requests Windows login
- IE will request the Windows login despite correct installation of the module. This can be due to the server not configured to be in the IE intranet zone or the security settings of IE are configured to always ask for username and password.
- Can't log out
- One of the features of SSO is that authentication data are automatically negotiated between browser and server. The result is that log in is transparent and automatically occurs immediately after the user logs out.
- Can't directly activate content
- When SSO is enabled Magnolia does not retain user related data and is unable to authenticate itself to public instances on behalf of the user. The result is that activation must be done via workflow when SSO is enabled.