PHP4/IIS5 ISAPI/CGI Authentication weirdness

> Hi all, > > I installed PHP4.0.2 on IIS5 (Windows 2000). Works beautifully. > I made a test-PHP-page that authenticates a user through PHP. > Here's the code: > > <? > if ($PHP_AUTH_USER == "" && $PHP_AUTH_PW == "" && > ereg("^Basic ", > $HTTP_AUTHORIZATION)) { > list($PHP_AUTH_USER, $PHP_AUTH_PW) = explode(":", > base64_decode(substr($HTTP_AUTHORIZATION, 6))); > } > $authenticated = 0; > if ($PHP_AUTH_USER != "" || $PHP_AUTH_PW != "") { > //put your authentication here (e.g. database lookup) > $authenticated = ($PHP_AUTH_USER == "test" && $PHP_AUTH_PW = > "123"); > } > if(!$authenticated) { > header("WWW-authenticate: Basic realm=\"DB-Admin\""); > if (ereg("Microsoft", $SERVER_SOFTWARE)) > header("Status: 401 Unauthorized"); > else > header("HTTP/1.0 401 Unauthorized"); > echo "Access denied"; > exit; > } > ?> > <HTML> > <HEAD> > <TITLE>test authentication</TITLE> > </HEAD> > <BODY> > test > </BODY> > </HTML> > > > Running this code on PHP4 when it is installed as an ISAPI produces > the expected results. A username/password popup appears, with (in > Netscape) the message "Enter username for DB-Admin at hostname:". > > Running the exact same code on PHP4 when it is installed as a CGI- > module, the WWW-authenticate header does not get sent to the client > anymore. Netscape shows "Enter username for unknown at hostname:". > Internet Explorer shows a "You are not authorized..." message > rightaway, > it doesn't even ask to login. > > If I telnet to port 80 and GET this page, I get those headers: > Trying 192.168.220.20... > Connected to winbak. > Escape character is '^]'. > GET /test.php > HTTP/1.1 401 Unauthorized > Server: Microsoft-IIS/5.0 > Date: Tue, 12 Sep 2000 19:48:57 GMT > Content-Length: 3550 > Content-Type: text/html > > The WWW-authenticate header is not there! Where did it go? > And why *is* the Unauthorized header there? > When I hack PHP4 a bit, it looks like PHP actually does output > the header, it looks like IIS filters it. > > Does anybody have any idea at all??? I am lost here... > BTW: I did not change any of my other setting in IIS when changing > from ISAPI to CGI. My directory security is set as "Anonymous access", > > both "Basic authentication" and "Integrated windows authentication" > are unchecked. > > Thanks for any help! > > Arjan > > -- > > ººººººººººººººººººººººººººººººººººººººººººººººººº > Arjan Haverkamp aka: void > Borneolaan 21 url: http://www.avoid.org > 1217 GX Hilversum email: arjan@nob.nl > The Netherlands "There's no gravity, > +31-35-6234660 the earth just sucks..." > > ººººººººººººººººººººººººººººººººººººººººººººººººº >