没有Windows身份验证的Internet SSO

Question

I have a web php application in the DMZ zone(internet), different domain with AD server. (AD server is intranet)

So, when staff in the intranet open this web app, how can they auto login by using windows credential? I tried Windows authentication, NTLM, but it's for intranet only.

Any idea that php can get current user's window's username without enable windows authenticate?

Answer 1

You need to setup an adfs server connected to your internal ad and then setup a federated login on the website, or use another federation solution. It is not trivial, but mustn't be expensive.