windows authentication problem...

[thephringe]

Hi all,

I'm new here so go easy on me...!

I have developed an intranet for my company using php/apache2/mysql but now want to change this so each user logs in with their domain account rather than a username/password that I have put in a mysql table.

I am planning to port the site over to IIS 6 and use integrated windows authentication which is no problem - I can now get the user logged in using their domain credentials.

However... I want to catch the username that they log in as so I can then determine who the user is and which department they work in (so I can give them different options). Can anyone tell me how I catch this variable in PHP?

Thanks,

Andy

[thephringe]

I should add that I am running PHP in ISAPI mode...

[TheDefender]

Maybe take a look at LDAP Functions in php.

[thephringe]

Thanks, defender, but I don't really need to talk to the ldap server - I don't need to know anything about the user. I just need to know who the user is... So whatever was typed in the username field of the authentication box, I need to have in a variable in my php page.

From there, I can compare that name to a database that will hold their details (ie full name, department, etc).

Thanks,

Andy

[TheDefender]

So you talking more like sessions? I assumed you were wanting to pull it out of the AD. If you are talking about a MySQL table or something, then you want to look into sessions/cookies.

[thephringe]

Basically what I will have is a mysql table that will have something like:

user_id (INT) = 1
username(VARCHAR)=john.smith
firstname(VARCHAR)=John
surname(VARCHAR)=Smith
department(VARCHAR)=Sales

The user then logs on using windows authentication as john.smith and enters their domain password.

The login page wouldn't then have to check their credentials as that is done by AD, but the page would check their username against that mysql table to find out what their full name is and which department they are in, so essentially all I need to find out is 'what did the current logged in user enter as their username?'

Thanks for your help

Andy

[TheDefender]

Ah, I gotcha now...
Are the users on a Win2K/XP environment, or are there WinNT machines in the mix too? (I have to look up some things on this one, but this info may come in handy.)

[thephringe]

It's a 2000/2003 domain - the domain controller is a win2k server box.

Thanks for your help here - I've been given a stupidly small amount of time to get this up and running!!

[Drakla]

On microsoft servers you can get the username and password for basic auth login via:

list($PHP_AUTH_USER, $PHP_AUTH_PW) = explode(':', base64_decode(substr($_SERVER['HTTP_AUTHORIZATION'], 6)));

then you can just check $PHP_AUTH_USER

Let me know if I've made a complete blunder on this

[thephringe]

Well, that's definately going somewhere Drakla!!

My code looks like this:

<?php
list($PHP_AUTH_USER, $PHP_AUTH_PW) = explode(':', base64_decode(substr($_SERVER['HTTP_AUTHORIZATION'], 6)));

echo $PHP_AUTH_USER;

?>

And when I log in using my username (currently I have to enter the domain as well): DATAINT\andrew.edmonds

the output is:

j×¾NTLMSSP„œ@Nj´‚ˆ dataintandrew.edmondsANDY-E-LAPTOP&ó“,ŝ5H¬

Now I can see in there my domain name, my user name (woo!) and the hostname of my laptop, but obviously it's surrounded by a whole lot of rubbish!!

Any thoughts?

[thephringe]

problem solved!

It's just another server variable:

echo $_SERVER["REMOTE_USER"];

REMOTE_USER can be used to identify the externally-authenticated user.

Thanks for your help anyway guys.

Andy