SvelteKit NTLM Auth

NTLM auth protocol for SvelteKit

Usage

• Import Handle

// src/hooks.server.ts
import { ntlm } from "@ajwdmedia/svelte-ntlm";

const ntlmHandle = ntlm({ 
    domainController: "ldap://...", // specify domain controller IP / Name
    domain: "...", // Your domain's name
    onAuthenticate: console.log, // Authentication Hook (not required) 
    timeout: 300, // Optional, time before revalidating, defaults to 5 minutes.
})

• Sequence before custom handles, ideally first as the hook controls some http requests.

// src/hooks.server.ts
import type { Handle } from "@sveltejs/kit";
import { sequence } from "@sveltejs/kit/hooks";

const localHandle = (async ({ event, resolve }) => {
    return resolve(event);
}) satisfies Handle;

export const handle = sequence(ntlmHandle, localHandle);

From here we can use it globally:

// src/hooks.server.ts
const localHandle = (async ({ event, resolve }) => {
    // trigger ntlm request and return whatever responses it needs
    const ntlm = event.locals.ntlm();
    if (!ntlm.passed) return ntlm.returns;
    // Domain/User info is in ntlm.info
    
    return resolve(event);
}) satisfies Handle;

or per path (for use with custom auth sessions eg lucia/authjs):

// src/routes/auth/ntlm/+server.ts
export const GET = async ( { locals, cookies }) => {
    // trigger ntlm request, returning whatever responses it needs
    const { passed, info, returns } = locals.ntlm();
    if (!passed) return returns;
    
    // lookup user by domain info
    const userData = await getUserData(info.domain, info.username);

    // then whatever user auth code
    const res = new Response(null, { status: 204 });
    const token = locals.auth.generateSessionToken();
    const session = await locals.auth.createSession(token, userData);
    locals.auth.setSessionTokenCookie(cookies, token, session.expiresAt);
    
    return res;
}

Known Issues

• Currently does not support auth without domain controller, wip.