Checking Windows machines domain membership

I noticed in the documentation mention of the issue with Windows machines popping up NTLM authentication boxes, which rather negates the point of the Negotiate module. We hit this some years ago with earlier version of simpleSAMLphp, and we couldn't just limit it by subnet as our users use a mix of organisationally owned domain bound machines and their own devices when on site.

I wrote a little work round that uses an extra, optional string in the negotiate module configuration in authsources.php called checkDomain. This is the AD domain name that the machine should be in. I then added an extra routine to the src/Auth/Source/Negotiate.php code to check this, with a call just after the subnet mask checks. It uses /usr/bin/nmblookup to search for the Windows machine, and ignores browsers that don't include "Windows NT" in their user agent string (so Linux boxes, Macs, etc).

In case it is of use, here's a diff of the changes against a recent version of the negotiate module:

$ diff Negotiate.php.dist Negotiate.php
58d57
< 
82a82
> 	$this->check_domain = $cfg->getOptionalString('checkDomain', NULL);
131a132,139
>         // Check if client is in allowed AD domain
>         $domainOK = $this->checkDomain();
>         if (!$domainOK) {
>             Logger::debug('Negotiate - Not a matching domain. falling back');
>             $this->fallBack($state);
> 	    return;
>         }
> 
226a235,267
>        /**
>          * checkDomain() looks up the domain that the client is bound into
>          *               and limits clients to the specified domain.
>          *
>          * Will return TRUE if no domain restriction option is configured.
>          *
>          * @return boolean
>          */
>         public function checkDomain(): bool {
>                 // No domain means all clients are accepted.
>                 if ($this->check_domain === NULL)
>                         return true;
> 
>                 // Only do this check for Windoze machines.
>                 $ua = $_SERVER['HTTP_USER_AGENT'];
>                 if (!preg_match("/Windows NT/", $ua)) {
>                    return true;           
>                 }
> 
>                 $ip = $_SERVER['REMOTE_ADDR'];
>                 $cmd = "/usr/bin/timeout 1 /usr/bin/nmblookup -A $ip 2>&1";
>                 $shellOutput = shell_exec($cmd);
>                 error_log($shellOutput,0);
>                 $lines = explode(PHP_EOL, $shellOutput);
>                 $myDomain = $this->check_domain;
>                 foreach ($lines as $line) {
>                   if(preg_match("/$myDomain\s+\<00\>\s\-\s\<GROUP\>.+ACTIVE/",
>                                 $line)) {
>                     return true;
>                   }
>                 }
>                 return false;
>         }

We've been using this in production on SSP 1.x IdP servers for many years now, and I've just ported it ready for use to move to SSP 2.x.

阅读 src/Auth/Source/Negotiate.php 和 authsources.php 配置，从现有的子网检查和提供的 diff 开始。验证可选的 checkDomain 设置应如何与 Windows NT 用户代理、nmblookup 以及回退行为交互；当文档化的配置和域检查已通过适当的验证集成后，工作即告完成。