Tag Archives: authentication

Drupal on Windows: Using SQL Server Merge Replication

August 26, 2011 Jonathan Briggs

In my first “Drupal on Windows” blog post, I wrote about using Windows authentication with SQL Server. That’s a recommended best practice for SQL Server in any production environment. So with the knowledge that Drupal can run on Windows technologies in a production environment, how can we scale Drupal to achieve high availability? How do we move beyond a single web farm?

One solution is:

Geographically dispersed web farms using Global Load Balancing
- Each web farm resides in it’s own data center
- Each web farm utilizes it’s own SQL Server instance
SQL Server Merge Replication
- Keep the database in each web farm in sync, so the served content is identical

SQL Server Merge Replication

Setting up merge replication (and global load balancing) is beyond the scope of this blog post, but there are lots of great instructions out there. I would recommend the following reading for those not familiar with merge replication: Continue reading Drupal on Windows: Using SQL Server Merge Replication →

Drupal

Drupal on Windows: Using Windows Authentication with SQL Server

July 12, 2011 Jonathan Briggs

With the release of Drupal 7, it became easy to run the whole Drupal stack on Windows technologies. Instead of requiring a LAMP stack (Linux, Apache, MySQL, PHP), you now have the option of a WISP stack (Windows, IIS, SQL Server, PHP). The excellent Drupal 7 driver for SQL server makes using a SQL Server backend with Drupal possible. Even better, the underlying PDO (PHP Data Objects) driver for SQL Server supports Windows authentication! But wait… there are no instructions provided on using Windows authentication to SQL Server with Drupal! I knew that in theory it should be possible. After some tweaking, I finally figured it out. So how do you set it up? Here are the missing instructions…

Getting Windows Authentication working with SQL Server

Before you start, you will need either:

A domain user account, with both web server and SQL server joined to the domain
-or-
Identical user accounts on both servers (same username and password); in this case the servers do not need to be joined to a domain

In my example below, I will use the identical user accounts method. Omit step 1 and substitute your domain account information wherever step 1 is referenced if you want to use the domain account method. Continue reading Drupal on Windows: Using Windows Authentication with SQL Server →

Active Directory Account Lockout: Causes and Solutions

July 5, 2011 jim

I had a user contact me recently with a locked out account. Casually, I unlocked it and prayed it wouldn’t become locked again. A few hours later the same user came back. So began the great lockout hunt…

Scanning the security logs on both domain controllers turned up several failed NTLM bad password events, but the source workstation field was blank. In this case, the easiest way to find the source workstation was to enable debug logging for the network logon service on each domain controller. Luckily, this is a quick registry edit that doesn’t require a system restart (instructions here). You should be able to search this output log for the user’s account alongside a 0x06A bad password attempt. In my case, it ended up being the user’s smart phone trying to connect to our 802.1x protected wireless network with a bad/old password.

Here are a few account lockout causes that I’ve come across:

user’s account in stored user name and passwords
user’s account tied to persistent mapped drive
user’s account as a service account
user’s credentials are cached on non domain joined virtual machines in the stored username and passwords/manage credentials windows application.
user’s account used as an IIS application pool identity
user’s account tied to a scheduled task
un-suspending a virtual machine after a user’s pw as changed
A SMARTPHONE!!!

Further resources:

Microsoft has a thorough outline of Account Lockout Best Practices along with common causes, troubleshooting steps and tools

The Poor Man’s Client-Side Authentication

June 30, 2011 yen

Recently I had to whip up a quick Web page to disseminate some information requiring a semblance of security in the form of a user name and password. Furthermore, I had HTML and Javascript but no server-side scripting at my immediate disposal. What I came up with as a solution was this.

Create a form for entering user name and password. This doesn’t have to be any more complicated than two input fields:

<label>User name:</label>

<input type='text" id='username" />

<label>Password:</label>

<input type='password" id='password" />

Add a button to submit the form:

<input id="btnSubmit" type="button" value="Submit" onclick="javascript:go()" />

Continue reading The Poor Man’s Client-Side Authentication →

SoftArtisans