How can I check if user has alread logged in into Windows Active Directory

Question

I've got a problem and since I am new to login/authentication stuff, I do not have clear vision about where to find the answer.

Here is the issue:

I am going to create webapp ( jsf with primefaces + ejb3 ) which allows users be logged into it without login dialog - which means, that all the auth info, about user's roles, groups etc must be gathered from Active Directory. How can I get that ? How can I get users info, if user did not provide at least his or her user name ? What about I must ask Active Directory domain?

Can somebody provide if not working one than at least pseudo-code?

Answer 1

If you are talking about Windows systems, Microsoft offers two protocols that are able to do SSO (Single Sign On), which is what you are looking for: NTLM and SPNEGO (a variant of Kerberos).

The answer to your question depends a bit on the operating system your application will run on. If that is Windows, then there are a couple of options that use the Windows API to make it a lot easier. ( mod-auth-sspi , Waffle )

If you are running other systems, you have to use libraries that provide the whole stack like Jespa , modauthkerb or others.