title: How does single sign-on (SSO) work with PHP + Apache against an Active Directory for transparent authentication?
body: <p>I need to get more understanding about SSO on a web app against Active Directory.</p>
  
  <p>For simply ask the user the login to authenticate on AD, I know that I can use some libraries like <code>Zend_Ldap</code>, <code>adLdap</code> and so on. But in this case, the user still need to type the login twice.
  For example: <a href="https://stackoverflow.com/questions/1711270/authenticate-against-active-directory-isa-from-php">Authenticate against Active Directory/ISA from php</a></p>
  
  <p>Afaik, to use <code>SSO</code> for <code>transparent login</code>, I need to implement an extra apache module. 
  For example: 
  <a href="https://stackoverflow.com/questions/1003751/how-do-i-use-microsoft-ad-and-php-single-sign-on-web-app">How can I implement single sign-on (SSO) using Microsoft AD for an internal PHP app?</a></p>
  
  <p><a href="https://stackoverflow.com/questions/1527735/authenticate-against-ldap-using-php-active-directory-while-using-ie-firefox">Authenticate against ldap using PHP, active directory, while using IE/Firefox</a></p>
  
  <p>First I need to know which apache module I need to use and why.
  In <a href="http://sivel.net/2007/05/sso-apache-ad-1/" rel="nofollow noreferrer">this article</a> for example there are three: <code>mod_ntlm</code>, <code>mod_auth_kerb</code> and <code>Apache2:AuthenNTLM</code>. 
  And the thosed one was <code>Apache2:AuthenNTLM</code></p>
  
  <p>In the <a href="https://stackoverflow.com/questions/1003751/how-do-i-use-microsoft-ad-and-php-single-sign-on-web-app/1570154#1570154">question</a> described above the accepted answer was for <code>mod_auth_sspi</code>.</p>
  
  <p>When talking about Active Directory <a href="https://serverfault.com/questions/204870/is-ldap-the-only-way-to-authenticate-an-web-application-against-active-directory/204873#204873">I've got this answer</a>, which describes active directory as an implementation of <code>ldap</code> + <code>kerberos</code> + "a few other miscellaneous bits and pieces".</p>
  
  <p>I'm very confused about all these names, since I've nerver worked with it.
  Can someone clarify it to me? (<code>ldap</code>, <code>kerberos</code>, <code>ntlm</code>, <code>sspi</code> etc)</p>
  
  <p>Finally, can someone point me to how the app recognize the authenticated user (from AD). Is it just by the username passed with somethink like <code>$_SERVER['REMOTE_USER']</code>? Any password is sent? How does the browser send this extra headers? Is there any local configuration that need to be done in each workstation?</p>