Repository navigation
Replies: 3 comments
|
Anyone ? |
|
I don't think NTLM Authentication is implemented in Keycloak. |
|
The NTLMv2 protocol is disappearing "on the wire", but NTLMv2 hashes will likely stick around much longer "as a concept" embedded into other protocols. A new Kerberos concept called "LocalKDC" should eventually help in replacing the NTLMv2 protocol with the Kerberos protocol on the wire, but this is still experimental. Microsoft started shipping a Kerberos Local Key Distribution Center (LocalKDC) Service to Windows Server 2025 but it isn't GA yet and causing People trouble. Meanwhile, LocalKDC and Samba was a hot topic at FOSDEM2025 (A local authentication hub). E.g. "Password Hash Synchronisation" with Entra ultimately relies upon NTLMv2 hashes but they're trasferred over a TLS connection where the client first authenticates the server, and the server PBKDF-hashes the NTLMv2 hashes at rest. From a Keycloak perspective (potentially bridging network-level SSO and web SSO) the concept of an NTLMv2 hash may remain relevant as a concept. Other frequently cited resources: |
Uh oh!
There was an error while loading. Please reload this page.
Hello Everyone.
We use Windows systems within our company. I've successfully integrated Keycloak with LDAP in the background.
I'm able to fetch users from Windows DC servers without any issues. What I want to achieve is to allow users to authenticate using the silent NTLM mechanism, enabling SSO logic without any form.
Please note that I'm specifically referring to NTLM, not Kerberos. Has anyone among you been able to accomplish this?
All reactions