Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When using basic authentication (specifically via LDAP, but htpasswd also) with Apache, it makes the REMOTE_USER variable available to the PHP / Ruby / Python code underneath -- this is very useful for offloading authentication to the webserver.

In our office environment we have lots of internal applications working like this over SSL, all quite secure. BUT: Apache exposes the PHP_AUTH_USER (=REMOTE_USER) and PHP_AUTH_PW variables to any application inside PHP. (PHP_AUTH_PW contains the plaintext password the user entered.) This means it's possible for the app to harvest usernames and passwords. Presumably the same information is available to Python and Ruby (all three are currently in use; PHP is being phased out).

So how can I prevent Apache from doing this?

One idea is to use Kerberos Negotiate authentication (which does not expose the password and has the benefit of being SSO), but that automatically falls back to Basic for some browsers (Chrome and in some cases Firefox), causing the password to be exposed again.

share|improve this question
up vote 1 down vote accepted

Radius is right -- you can't.

After further research I realised that this is basically a text-book scenario for an identity assertion: A trusted identity provider "proves" the user's identity to the client application. The SAML 2.0 specification seems a good fit.

I was hoping to get away without more infrastructure layers, but I'm going to go with simpleSAMLphp[1] for the IDP and mod_mellon[2] for the Apache side. (A day's worth of tinkering and it works.) This doesn't solve the password problem, but moves it to where it can be controlled.

Aside: Sun's OpenSSO is quite beefy but Oracle killed it and the related OpenAM project's future is still not clear.

[1]: simpleSAMLphp

[2]: mod_mellon

share|improve this answer
Radius is'n 100% right. You can prevent using password authentication by server using mod_auth_kerb and setting KrbMethodK5Passwd off – sumar Jan 14 '11 at 11:35
That would lock out users of some browsers, which I don't want to do. – Marius Marais Feb 15 '11 at 12:03

Seems not possible but see
Post #8 suggest to use auto_prepend_file to run a script that unset the variable
It's a workaround not a clean solution but it exist...

Did you try AuthType Digest ?

share|improve this answer
Unfortunately LDAP doesn't support Digest – Marius Marais Jun 6 '10 at 11:49

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.