note 11139 deleted from features.http-auth by irc-html
| From: | irc-html@php.net | Date: | Sat, 19 Jan 2002 20:28:36 +0000 |
| Subject: | note 11139 deleted from features.http-auth by irc-html | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-25312@lists.php.net to get a copy of this message | ||
HTTP authentication does not work on IIS using the CGI even when using the method in the note by
brecht@sanders.org; A bug in IIS causes it to drop all interesting
headers (Www-authenticate and so forth) when a CGI produces a 401,
replacing them and any output with a really unhelpful message. (see
also Q176113 in the MSDN knowledgebase - it causes other problems).
However, there is a possible workaround for authenticating
using CGI: Use a separate file named 'nph-login.php' and a
pair of functions authenticate_user() and ensure_authenticated()
stashed in a library.
When a script's name starts with "nph-" IIS will leave its headers
alone, which means that the script has to provide all of them, but
also that IIS won't mess with them.
When the user needs to authenticate, ensure_authenticated() will
redirect him/her to nph-login.php; when a correct username/password
has been entered, this file redirects the user right back.
--- begin library functions --
// Authenticate user is as in the referenced note: retrieve and
// parse auth info, checking against database
function authenticate_user() {
// authenticate the user for a webserver realm using basic authentication
global $HTTP_AUTHORIZATION, $PHP_AUTH_USER, $PHP_AUTH_PW;
$authenticated = 0;
if ($PHP_AUTH_USER == ""
&& $PHP_AUTH_PW == ""
&& ereg("^Basic ", $HTTP_AUTHORIZATION)) {
list($PHP_AUTH_USER, $PHP_AUTH_PW) =
explode(":", base64_decode(substr($HTTP_AUTHORIZATION, 6)));
}
if ($PHP_AUTH_USER != "" || $PHP_AUTH_PW != "") {
//put your authentication here (e.g. database lookup)
if ($PHP_AUTH_USER == "test" && $PHP_AUTH_PW == "123") {
$authenticated = 1;
}
}
return $authenticated;
}
// ensure_authenticated uses authenticate_user() and
// redirects to the nph-script when that fails:
function ensure_authenticated() {
global $PHP_SELF;
if (authenticate_user()) {
return 1;
} else {
header("Location: nph-login.php?REQUESTED=$PHP_SELF");
exit;
}
}
--- end library functions --
--- BEGIN FILE nph-login.php ---
if (authenticate_user()) {
global $REQUESTED; // get page to display from URL
if (!isset($REQUESTED)) {
// don't know what page wants to authenticate -
// add a sane default or just exit
$REQUESTED = "/";
}
header("HTTP/1.0 301 Moved Permanently");
header("Location: $REQUESTED");
exit;
} else {
header("HTTP/1.0 401 Unauthorized");
header("WWW-Authenticate: Basic realm=\"Protected\"");
header("Status: 401 Unauthorized");
header("Content-type: text/html");
}
?>
<html>
<head>
<title>Can't log in</title>
</head>
<body>
<p> You have to supply a username and password. </p>
</body>
</html>
--- END FILE nph-login.php ---