NTLM authentication

This document describes how to set up NTLM/Integrated Authentication in Moodle. It uses a modified version of LDAP Authentication.

Assumptions

you are running a MS Active Directory for Authentication.
The Server hosting your website is a member of the Active Directory Domain that your users are also members of.
you are able to define people inside your Network (and authenticated to the Domain) from an IP range or IP range of computers.
you have "some" basic knowledge of php and are able to configure the index.php with the range of internal IP addresses.
you are familar with or have read the LDAP authentication documentation.

Installation

Copy the folder AUTH/NTLM into the AUTH folder of your moodle installation.
Modify the auth/ntlm/index.php file, This file handles which login page to use based on the IP address of the user. if inside your network, they should be directed to the oncampuslogin.php screen. if outside your network, they should be directed to the offcampuslogin.php screen. you will need to modify the if statements in this file to match the IP ranges inside your network.
Turn Integrated Authentication ON and Anonymous Authentication OFF for the moodle\auth\ntlm\oncampuslogin.php file. (see below for more detailed instructions.
Visit the admin page of your moodle installation - you should see notification that the NTLM_AUTH module has been installed.
go to the configuration > variables page, find the dbsessions setting, and set it to "YES" then save the page.
go to the Authentication admin page and select auth_ntlmtitle as your authentication method Note: - this doesn't display full text as I haven't created a language file for this module - you will also see auth_ntlmdescription instead of a proper description - you don't need to worry about this, as you will be the only one who ever sees this.
Configure this page with your normal LDAP settings. NOTE: the Alternate Login URL at the bottom of this page has been set to the NTLM page. - if you wish uninstall this auth module, you must reset this variable on the new authentication type page. eg - if you wish to revert back to manual authentication, then change to manual, and then make sure you delete the alternate login url at the bottom of the page.
(OPTIONAL) modify the offcampuslogin page to give errors when students try to prefix their usercode with your domain.

around line 216 find this code, uncomment all the lines and replace the letters 'DOM' with your domain:

   if (empty($errormsg)) {
       if (strstr(strtolower($frm->username), "DOM\\") <> false) { //NAD - DOM messages.
           $errormsg = get_string("invalidlogin") . " DOM\\ is not required!";
       } else if (strpos($frm->username, "@") <> false) {
           $errormsg = get_string("invalidlogin") . " enter your username - not your e-mail address.";
       } else {
           $errormsg = get_string("invalidlogin");
       }
   }

How to Turn Integrated Authentication on

The File oncampuslogin.php MUST have NTLM/Integrated Authentication enabled at the server or the page will not work.

IIS Configuration

open up IIS, and find the auth/ntlm/oncampuslogin.php file,

right click on the file, choose properties
under the "file security" tab, click on the Authentication and Access control "edit" button
untick "enable anonymous access" and tick "Integrated Windows Authentication"

APACHE Configuration

NOTE: No-one seems to have tested this yet - so be careful with this:

get the NTLM auth Module for Apache from: http://modntlm.sourceforge.net/
use something like this in your httpd.conf: http://moodle.org/mod/forum/discuss.php?d=45887#211074

Notes/Tips

dbsessions is required to be set to "YES" because when Integrated authentication is turned on for the oncampuslogin.php page, and dbsessions is set to "NO" then the server impersonates the user to write the session in the moodledata\sessions folder. The reccommended fix is to set dbsessions to "YES" so that sessions are stored in the db. The non-reccommended alternative method is to allow domain users write access to the sessions directory.
If you forget to change the internal IP addresses in index.php to your own, you can just use the offcampuslogin url to login using your admin account. eg: http://yoursite.com/moodle/auth/ntlm/offcampuslogin.php

Specific File information

(mainly for developers)

auth\ntlm\index.php
This is the page used for the Alternate Login URL setting on the config page for the NTLM plugin.
The index.php file handles which login page to use based on the IP address of the user.
if inside your network, they should be directed to the oncampuslogin.php screen.
if outside your network, they should be directed to the offcampuslogin.php screen.
you will need to modify the if statements in this file to match the IP ranges inside your network.
auth\ntlm\index_form.html
this is a copy of the file login\index_form.php.
The only change in this file from the standard one is that the form action="index.php" is changed to form action="offcampuslogin.php" this is because anyone who is displayed the form will be an offcampus user.
auth\ntlm\offcampuslogin.php
this is a copy of the file moodle\login\index.php with a couple of minor modifications.
the modifications to this file involve the setting of a variable ($onoroffcampus = "offcampus";) this is used by the auth plugin to define which page is being used for authentication. the other modification is for displaying extra error messages to the user. - with all the authentication methods we have students are constantly confused about how to enter their credentials if you use NTLM authentication elsewhere at your site you will be aware of the users having to enter the domain\username when authenticating. - this code block sits around line 215 in the file.
auth\ntlm\oncampuslogin.php
this is a copy of the file login\index.php
This file has been modified to get the details of the authenticated user via NTLM.

Documentation