Intranet Windows Xp UserName

[piersk]

I reckon that if the webserver had been on the same domain then it should have been ok, but I also agree that there is probably some networking involved.

TBH, since it's about 20 miles away and just on the Net, it wouldn't have been very secure to have our usernames thrown out onto the net.

[AstroTeg]

Originally posted by chriskhtx
I had the same problem. I used ASP. It works great. We are running a windows 2000 domain, not Active Directory yet.

<% Response.Write Request.ServerVariables("LOGON_USER") %>

That line will echo the domain and username in this format:
DOMAIN\User.Name

Then you can pass that variable to php.

Supposedly you can use $_SERVER['PHP_AUTH_USER'] in php as long as your authentication is set to NTLM and not Basic. But I was never able to get that to work.

Hope that helps,
Chris

To get "LOGON_USER", you'd still have to setup a challenge/response (can't have IIS defaulted to anonymous access). htp://support.microsoft.com/default.aspx?scid=KB;en-us;q188717

If it works, great! But at our shop, we didn't want to prompt the user for authentication. We just wanted to snag their network login ID and automatically authenticate them that way. We didn't have any success with "LOGON_USER" which is why we went with ActiveX.

[chriskhtx]

We'll, my understanding is that they have authentication setup as NTLM instead of Basic. It doesnt prompt for a username and password, it just snags it. For some reason, ASP will work, but I cannot get the PHP equivalent to work.

Thanks,
CHris

[AstroTeg]

Originally posted by chriskhtx
We'll, my understanding is that they have authentication setup as NTLM instead of Basic. It doesnt prompt for a username and password, it just snags it. For some reason, ASP will work, but I cannot get the PHP equivalent to work.

Have you tried using [man]phpinfo[/man] to see if its in one of the variables?

[chriskhtx]

I hadn't checked it. But on version 4.3.2 that is installed. It says:
AUTH_TYPE NTLM

AUTH_USER MYDOMAIN\My.Username

It does show my domain and my username..... thats weird, because I could not get it to echo that value with $_SERVER['AUTH_USER'].. it would always be empty.

Just saw that LOGON_USER, REMOTE_USER and UNMAPPED_REMOTE_USER also have my domain and username in them.

[tommynanda]

Isnt that easier to user exec() command with Windows "Net Name" command?

TommYNandA

[chriskhtx]

Well, that didnt work.. however.. for some reason or another, the reason $SERVER['AUTH_USER'] wasnt working was because I had inadvertantly used $SERVER['PHP_AUTH_USER']; I have no idea where I got that from. :o

[groovepapa]

since the Request.ServerVariables("LOGON_USER") is clearly a server variable, it's accurate to say that $_SERVER['LOGON_USER'] would return the same server variable.

I think the problem is most likely that IE/IIS establish this LOGON_USER server variable by default, perhaps IE merely sends IIS the registry key value that was referred to.

I seriously doubt, though, that IE would as easily send the same value to Apache for it to hold as a server variable, and that is probably why the php code will not return the same as the ASP code.

is someone more familiar with the way IE sends values to a web server and if it indeed only sends some into certain servers (IIS)?

we're trying to accomplish the same thing...getting the username from the browser into our PHP code.

[chriskhtx]

Well, I was able to get it to work using $_SERVER['AUTH_USER'];
I had made an error in my code. However, we are running IIS in an intranet setup. I thought I had read somewhere that it can't be done with apache. Atleast not transparently (auth screen pops up).. but I could be mistaken as it has been quite some time since I read it.

Also, the value that I get using $_SERVER['AUTH_USER'] is DOMAIN\User.Name

-Chris

[groovepapa]

there is a method listed on this other post that I'm going to try with our Linux/Apache setup. I will post the corresponding javascript code if it works.

or you could try the hacking solution involving NetBIOS if you know your users won't be behind firewalls.

[groovepapa]

It has been a long time, but I finally discovered how to do this and wanted to include my solution in case anyone else in this situation can use it.

I began to suspect that MS was up to some sneaky proprietary authentication between IIS and IE. Sure enough, they use NTLM Don't worry too much about the technicals of NTLM, because some other people have already cleared it up.

Download and install mod_ntlm for Apache and make the httpd.conf authentication settings for your own environment. (Note: NTLMDomain is your windows domain, NTLMServer is the host name of the ie, ActiveDirectory server; you should put quotes around both of these values). Restart apache.

You should be able to hit pages on the Apache server without providing authentication - mod_ntlm should work out the authentication implicitly, and there will now be an Apache REMOTE_USER variable containing the username under which IE is running.

HTH.

[chriskhtx]

Excellent. Thanks for the solution!