Requirements : 

For NTLM the following library are needed in the classpath :
a) jcifs-1.1.8.jar from JCIFS project 
http://jcifs.samba.org/

b) jcifs-ext-0.9.4 from JCIFS-ext project
http://sourceforge.net/projects/jcifs-ext/

Usage : the module authenticates a given username/password on a domain controler via NTLM protocol. If the user exists, the groups of the user are returned as roles (e.g. Domain Users, Domain Admins).
The user principal class is org.jaaslounge.UserPrincipal.
The role class is org.jaaslounge.GroupPrincipal.

For general information see JAAS API official documentation.

Web-apps : refer to the documentation of your server. Put jaaslounge-ntlm, jcifs and jcifs-ext jars in the correct classpath.

Login module configuration options :
debug = true|false : displays debug information
mode = tomcat|jboss : organize user and role information according to tomcat or jboss implementation
host = <"ip adress">|<hostname> : address of Windows NT domain controller or Samba server
domain = <domain name> : NT or Samba domain name

Example of login module configuration for Tomcat 5.0.x server :
jaas.config :
NT_Realm {
   org.jaaslounge.ntlm.NtlmLoginModule required 
   debug=true 
   mode=tomcat
   domain=MYDOMAIN    
   host="192.168.0.1";
};

security descriptor (<myapp>.xml or server.xml) :
<Realm className="org.apache.catalina.realm.JAASRealm" appName="NT_Realm" roleClassNames="org.jaaslounge.ntlm.NtlmGroupPrincipal" userClassNames="org.jaaslounge.ntlm.NtlmUserPrincipal" debug="99" useContextClassLoader="false" /> 

Example of login module configuration for JBoss 3.2.x server :
<application-policy name="web-console">
  <authentication>
    <login-module code="org.jaaslounge.NtlmLoginModule" flag="required">
    <module-option name="debug">true</module-option> 
    <module-option name="mode">JBoss</module-option>
    <module-option name="domain">MYDOMAIN</module-option> 
    <module-option name="host">192.168.0.1</module-option> 
  </authentication>
</application-policy>

Known bugs and limitations :
- users without password cannot be authenticated.