An express middleware to have simple NTLM-authentication.


An express middleware to have basic NTLM-authentication in node.js.

Upgrading from 1.0: The fields for username, domain and workstation have different names now: UserName, DomainName, Workstation.

Active Directory support is heavily inspired by PyAuthenNTLM2.

$ npm install express-ntlm
var express = require('express'),
    ntlm = require('express-ntlm');

var app = express();

    debug: function() {
        var args = Array.prototype.slice.apply(arguments);
        console.log.apply(null, args);
    domain: 'MYDOMAIN',
    domaincontroller: 'ldap://myad.example',

app.all('*', function(request, response) {
    response.end(JSON.stringify(request.ntlm)); // {"DomainName":"MYDOMAIN","UserName":"MYUSER","Workstation":"MYWORKSTATION"}


It's not recommended, but it's possible to add NTLM-Authentication without validation. This means you can authenticate without providing valid credentials.

badrequestfunctionfunction(request, response, next) { response.sendStatus(400); }Function to handle HTTP 400 Bad Request.
internalservererrorfunctionfunction(request, response, next) { response.sendStatus(500); }Function to handle 500 Internal Server Error.
forbiddenfunctionfunction(request, response, next) { response.sendStatus(403); }Function to handle HTTP 403 Forbidden.
prefixstring[express-ntlm]The prefix is the first argument passed to the debug-function.
debugfunctionfunction() {}Function to log the debug messages. See logging for more details.
domainstringDefault domain if the DomainName-field cannot be parsed.
domaincontrollernull / string / arraynullOne or more domaincontroller(s) to handle the authentication. If null is specified the user is not validated. Active Directory is supported.

function() {
    var args = Array.prototype.slice.apply(arguments);
    console.log.apply(null, args);

logging to debug (or similiar logging-utilities)

function() {
    var args = Array.prototype.slice.apply(arguments);
    debug.apply(null, args.slice(1)); // slice the prefix away, since debug is already prefixed

All NTLM-fields (UserName, DomainName, Workstartion) are also available within response.locals.ntlm, which means you can access it through your template engine (e.g. jade or ejs) when rendering using ntlm (e.g. <%= ntlm.UserName %>).