# Single Sign On in an Intranet Environment **URL:** \ **Category:** Getting Started\ **Created:** [February 21, 2025, 6:40am UTC](https://forum.djangoproject.com/t/single-sign-on-in-an-intranet-environment/38988 "2025-02-21T06:40:38Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![bioscom](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/bioscom/32/26916_2.png) [@bioscom](https://forum.djangoproject.com/u/bioscom)\ **Post date:** [February 21, 2025, 6:40am UTC](https://forum.djangoproject.com/t/single-sign-on-in-an-intranet-environment/38988/1 "2025-02-21T06:40:38Z")
Good day and thanks for your previous Supports, they are very wonderful. I have a challenge in an my appplication. I want users to login using Single SignOn in an Intranet environment. The users are registered in the database, when they click the URL it checks their META data to see if their username exists in the database, if found it takes them to the application directly, using the code below. ```auto def user_login(request): #username = request.META['REMOTE_USER'] try: username = request.META['USERNAME'] if User.objects.get(username=username): request.user = User.objects.get(username=username) #messages.success(request, "Welcome!!!") return redirect("/en/home") else: messages.error(request, 'You do not have access to the application, contact the administrator!!!') return redirect("/login_page") except Exception as e: print(traceback.format_exc()) return redirect("/login_page") ``` I read online that I can use request.META[‘REMOTE\_USER’], but it did not work for me. The challenge I have now is that, when I call a method from my view.py, I need to declare ```auto username = request.META['USERNAME'] request.user = User.objects.get(username=username) ``` in all methods, else request.user will be lost. How can I make it global throughout the application without calling `request.META['USER_NAME']` in all methods in my view.py. Thank you. ---
**Author:** ![leandrodesouzadev](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/leandrodesouzadev/32/8981_2.png) [@leandrodesouzadev](https://forum.djangoproject.com/u/leandrodesouzadev)\ **Post date:** [February 21, 2025, 11:32am UTC](https://forum.djangoproject.com/t/single-sign-on-in-an-intranet-environment/38988/2 "2025-02-21T11:32:07Z")
> [@bioscom](#): > > I read online that I can use request.META[‘REMOTE\_USER’], but it did not work for me. That’s quite vague, have you followed the instructions from the [docs - How to authenticate using `REMOTE_USER`](https://docs.djangoproject.com/en/5.1/howto/auth-remote-user/#how-to-authenticate-using-remote-user)? > [@bioscom](#): > > in all methods, else request.user will be lost. Well, from this statement it looks like you don’t quite know how authentication works on Django. I suggest that you review this section of the [documentation - How to log a user in](https://docs.djangoproject.com/en/5.1/topics/auth/default/#how-to-log-a-user-in). After you use the mentioned function, Django will return a Cookie that will be stored by the user browser, and that cookie will be sent on every request, and Django will populate `request.user` on the auth middleware. Side Note: I have never implemented such feature, and its easy to mess up with security, but as long as this is an Intranet application you won’t have much problems. ---
**Author:** ![KenWhitesell](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/kenwhitesell/32/280_2.png) [@KenWhitesell](https://forum.djangoproject.com/u/KenWhitesell)\ **Post date:** [February 21, 2025, 1:33pm UTC](https://forum.djangoproject.com/t/single-sign-on-in-an-intranet-environment/38988/3 "2025-02-21T13:33:49Z")
When you are considering Single SignOn authentication, you’ve got two different elements that need to be addressed. In the general case, you need _one_ authoritative source for credential validations. You want all systems to have one system that they all trust to verify that the person presenting credentials is presenting the correct credentials. Then, once _that’s_ done, then that identification information must be presented to all the systems in a way that is reliable and secure, such that each target system can validate the identification being presented. What you’re looking for then is a type of token-based authentication. We use the [Central Authentication Service](https://en.wikipedia.org/wiki/Central_Authentication_Service) (CAS) protocol. There is both a [Django-based CAS server](https://github.com/nitmir/django-cas-server) and [a Django client](https://github.com/django-cas-ng/django-cas-ng) for this. I will admit, it took me a while to wrap my head around the sequence of events involved with CAS - the diagram at [https://unicon.github.io/cas/4.2.x/images/cas\_flow\_diagram.png](https://unicon.github.io/cas/4.2.x/images/cas_flow_diagram.png) helped a **lot**. You’ll also find other protocols that provide this same facility (including Microsoft Active Directory authentication), but they all fundamentally work the same way. - User authenticates to an authentication server. That server gives a token back to the browser. - The User is redirected to the server running the application they want to use, passing that token to _that_ server. - The application server receives the token and validates it with the authentication server. ---
**Author:** ![bioscom](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/bioscom/32/26916_2.png) [@bioscom](https://forum.djangoproject.com/u/bioscom)\ **Post date:** [February 21, 2025, 2:46pm UTC](https://forum.djangoproject.com/t/single-sign-on-in-an-intranet-environment/38988/4 "2025-02-21T14:46:39Z")
Thanks for your response. I really appreciate. I don’t want my users to login with username and password. As long as they can logon to their PC through Microsoft Active Directory authentication, I want them to use same authentication to login to the application. Though, my solution works, just that it is not the right way. it picks the user from the user table and logs them in, but I need to reload the request.User at every stage and that is what I don’t want to be doing. Thank you. ---
**Author:** ![KenWhitesell](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/kenwhitesell/32/280_2.png) [@KenWhitesell](https://forum.djangoproject.com/u/KenWhitesell)\ **Post date:** [February 21, 2025, 3:05pm UTC](https://forum.djangoproject.com/t/single-sign-on-in-an-intranet-environment/38988/5 "2025-02-21T15:05:22Z")
> [@bioscom](#): > > As long as they can logon to their PC through Microsoft Active Directory authentication, I want them to use same authentication to login to the application. Well, it is the same - only they’re logging in from the workstation and not the browser, the fundamental idea is the same. How are you running the server? (Are you serving your apps under IIS or something else?) How are you currently getting the user information? ---
**Author:** ![bioscom](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/bioscom/32/26916_2.png) [@bioscom](https://forum.djangoproject.com/u/bioscom)\ **Post date:** [February 21, 2025, 3:20pm UTC](https://forum.djangoproject.com/t/single-sign-on-in-an-intranet-environment/38988/6 "2025-02-21T15:20:14Z")
I am serving the app using IIS. The user information comes from Microsoft Active Directory. But I like your solution. I will implement it in my next project. Thanks a lot. I love this space. ---
**Author:** ![KenWhitesell](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/kenwhitesell/32/280_2.png) [@KenWhitesell](https://forum.djangoproject.com/u/KenWhitesell)\ **Post date:** [February 21, 2025, 3:39pm UTC](https://forum.djangoproject.com/t/single-sign-on-in-an-intranet-environment/38988/7 "2025-02-21T15:39:37Z")
So it’s IIS that is setting the `REMOTE_USER` header? If so, then yes - the docs listed above referencing the `REMOTE_USER` middleware is what you’re looking for.