Re: [PHP4BETA] IISAPI module: do we really need to have a Filterand Extension?

As I recall, when originaly working on the isapi stuff, we do have to have a filter, otherwise, iis will attempt to authenticate against the NT user database, or some other filter will take over, which you don't want. You have to 'fake' the authentication to get it passed to php, meaning you must map the provided username/password to an nt username/password for things to work right. Peter Bowen wrote: > > On that same page there is an AUTH_TYPE that defines which type of > authentication was used by the client. > Anything other than basic will have a null password. > Would it be worth-while to add a PHP_AUTH_TYPE variable so that our own > authentication routines are aware > of potential problems resulting from an earlier authentication filter taking > precedence? > > If we implement this, the documentation should have the following warning: > Note: In respect to AUTH_TYPE, if the string is not empty it does not mean > the user was authenticated (if the authentication scheme is not Basic or > integrated Windows authentication). The server allows authentication schemes > it does not natively support because an ISAPI filter may be able to handle > that particular scheme. > This is from Microsoft's MSDN web page. > > Thanx. > Peter > > -----Original Message----- > From: Nuno Leitao [mailto:nuno@zeustechnology.com] > Sent: Monday, December 06, 1999 8:01 AM > To: Thies C. Arntzen > Cc: Zeev Suraski; php4beta@lists.php.net > Subject: Re: [PHP4BETA] IISAPI module: do we really need to have a > Filterand Extension? > > Hi ya, > > "Thies C. Arntzen" wrote: > > the zeus-server will give us this information > > (MS_REMOTE_USER,MS_REMOTE_PASSWD), so i guess i'll use > > it for the zeus-isapi module and we'll keep it as it is for the M$-IIS. > > I'm sorry -- I looked at the wrong side of the #define :) > The variables are actually called: "REMOTE_USER" and "REMOTE_PASSWD", > *not* "MS_REMOTE_USER" and "MS_REMOTE_PASSWD". Sorry for that. > > If you go to: > > http://msdn.microsoft.com/library/psdk/iisref/isre504l.htm > > there is a password list. Apparently IIS doesn't define REMOTE_PASSWD, but > they define their own "AUTH_USER" and "AUTH_PASSWD" for the same purpose. > You should note however that these variables are only available if you > are using the "Basic" authentication method. > > Cheers.