Win 2003 IIS6 PHP_AUTH_USER blank!

MattWorrall

Hi,

I'm trying to publish a site from my dev box to my live box.

The site uses PHP Http Authentication to password protect some areas.

It works fine on my dev box. However, on my live box, PHP_AUTH_USER and PHP_AUTH_PW are always empty!

Even the standard test script below prompts for the username and password 3 times then defaults to "Unauthorized".

<?php
if (!isset($_SERVER['PHP_AUTH_USER'])) {
    header('WWW-Authenticate: Basic realm="My Realm"');
    header('HTTP/1.0 401 Unauthorized');
    echo 'Text to send if user hits Cancel button';
    var_dump($_SERVER);
    exit;
} else {
    echo "<p>Hello {$_SERVER['PHP_AUTH_USER']}.</p>";
    echo "<p>You entered {$_SERVER['PHP_AUTH_PW']} as your password.</p>";
var_dump($_SERVER);
}
?>

Both boxes are Win 2003, IIS6.

On the dev box, PHP 5.2.1 running as CGI.

On the live box, PHP 5.2.4 running as ISAPI.

I've tried absolutely everything I can think of without success. Any ideas?

Cheers

NogDog

Can you run a little test to see if the variable $SERVER['HTTP_AUTHORIZATION'] is populated with anything? If so, you may need to use it instead of the PHP_AUTH variables. See this note from the HTTP authentication manual page:

Another limitation is if you're using the IIS module (ISAPI) and PHP 4, you may not use the PHP_AUTH* variables but instead, the variable HTTP_AUTHORIZATION is available. For example, consider the following code: list($user, $pw) = explode(':', base64_decode(substr($SERVER['HTTP_AUTHORIZATION'], 6)));

While it seems to imply that this is only for PHP 4, it still might be worth looking into. Also, just below that is this note:

IIS Note:: For HTTP Authentication to work with IIS, the PHP directive cgi.rfc2616_headers must be set to 0 (the default value).

So, you might want to double check that it is set to 0.

MattWorrall

Thanks. Tried both of those, but $_SERVER['HTTP_AUTHORISATION'] is not returned either :mad:

This is really weird....