Mac Forum / Applications / Other MS Products / November 2004

You should be looking into using Kerberos for authentication.  If you have
an application, it should use the gssapi part of Apple's Kerberos framework
to authenticate your application to it's corresponding service on the
windows domain.  

If you do this, then you will automatically get single sign on support when
the Mac has been joined to the domain using either ADmitMac or Apple's
Active Directory plug-in.  When users log in, the Mac will handle
authentication with the domain, getting the user's Kerberos ticket granting
ticket.  

Once the user has a TGT, then your application should be able to
authenticate using gssapi calls with whatever domain service you need.  If
the user hasn't logged in using domain credentials, then your application
(if graphical) would cause the Kerberos login app to launch and authenticate
the user, asking for their username and password.

This is a very secure way to build your app, because it never has to ask for
the user's password.

If your app is connecting to a standard service, like http, ldap or cifs,
you will need to do a little work to figure out how to make use of the
gssapi calls.  If the service is your own, then things get even easier
because there are some good sample client/server apps that you can use to
figure out how to use gssapi.

-
Paul Nelson
Thursby Software Systems, Inc.