Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've been able to get this working using XAMP with Apache 2.0.55 and XAMP Apache 2.2.14 without any problems.

However, when I attempt to configure our intranet server (Apache 2.0.59), I don't get the same results.

The results are that the following variables contain the information desired: $_SERVER["REMOTE_USER"] AND $_SERVER["PHP_AUTH_USER"]. In this case, they are blank. I'm expecting "domain/user_name".

Conf file stuff:

<Directory "/xxx/xampp/htdocs/">
    #
    # Possible values for the Options directive are "None", "All",
    # or any combination of:
    #   Indexes Includes FollowSymLinks SymLinksifOwnerMatch ExecCGI MultiViews
    #
    # Note that "MultiViews" must be named *explicitly* --- "Options All"
    # doesn't give it to you.
    #
    # The Options directive is both complicated and important.  Please see
    # http://httpd.apache.org/docs/2.2/mod/core.html#options
    # for more information.
    #

    #Options Indexes FollowSymLinks Includes ExecCGI
    Options Indexes FollowSymLinks

    #
    # AllowOverride controls what directives may be placed in .htaccess files.
    # It can be "All", "None", or any combination of the keywords:
    #   Options FileInfo AuthConfig Limit
    #

    #AllowOverride All
    AllowOverride None

    #
    # Controls who can get stuff from this server.
    #
    #Order allow,deny
    #Allow from all
    Order allow,deny
    Allow from all


    #NT Domain Login
    AuthName "Intranet"
    AuthType SSPI
    SSPIAuth On
    SSPIAuthoritative On
    SSPIDomain "xxxx"
    SSPIOfferBasic Off
    SSPIPerRequestAuth On
    SSPIOmitDomain Off      # keep domain name in userid string
    SSPIUsernameCase lower
    Require valid-user 
</Directory>

I would like to note that I've modified the paths to reflect the intranet environment.

I'm using the following module: http://sourceforge.net/projects/mod-auth-sspi/

Once the module is installed and the conf file is modified, the intranet environment's server scope isn't populated with the expected variables.

Edit #1

<Directory "/path_here">
    #
    # Possible values for the Options directive are "None", "All",
    # or any combination of:
    #   Indexes Includes FollowSymLinks SymLinksifOwnerMatch ExecCGI MultiViews
    #
    # Note that "MultiViews" must be named *explicitly* --- "Options All"
    # doesn't give it to you.
    #
    # The Options directive is both complicated and important.  Please see
    # http://httpd.apache.org/docs/2.2/mod/core.html#options
    # for more information.
    #

    #Options Indexes FollowSymLinks Includes ExecCGI
    Options Indexes FollowSymLinks

    #
    # AllowOverride controls what directives may be placed in .htaccess files.
    # It can be "All", "None", or any combination of the keywords:
    #   Options FileInfo AuthConfig Limit
    #

    #AllowOverride All
    AllowOverride None

    #
    # Controls who can get stuff from this server.
    #
    #Order allow,deny
    #Allow from all
    Order allow,deny
    Allow from all


    #NT Domain Login
    AuthName "Intranet"
    AuthType SSPI
    SSPIAuth On
    SSPIAuthoritative On
    SSPIDomain "domain_here"
    SSPIOfferBasic On
    SSPIPerRequestAuth On
    SSPIOmitDomain Off      # keep domain name in userid string
    SSPIUsernameCase lower
    Require valid-user 
</Directory>
share|improve this question

migrated from stackoverflow.com Apr 5 '11 at 14:13

This question came from our site for professional and enthusiast programmers.

3 Answers 3

up vote 0 down vote accepted

I've been there and stumble uppon those problems ...

Wild guess, your intranet is on a proxy ?

This is my SSPI conf, the only difference I see is that I use LocationMatch instead of Directory

<LocationMatch ^/$>
    AuthType SSPI
    AuthName "TECHNO"
    SSPIAuth On
    SSPIAuthoritative On
    SSPIOfferBasic On
    Require valid-user
</LocationMatch>

For SSPI to work with PHP I had to use LDAP (php ext). I cannot help you further without more infos.

Phil

share|improve this answer
    
Our intranet isn't using a proxy. Also, why would you need to have LDAP in the mix? At our end, all we want is to have the domain/user in order to look up in our authentication database and log the user in really (which works in both XAMP versions). I will checkout your approach as well. You never know. Thanks! –  TekiusFanatikus Apr 7 '11 at 19:24

What is happening I am guessing is you are using a FQDN or IP to access the intranet server, while you used something like "localhost" to access your development environment.

The problem here is that your web browser see's the FQDN and assumes you are accessing an external website; while we know this is incorrect it is assumed this way for safety reasons. As a result the browsers will instead prompt the user for a login. This however is not happening for you because you have "SSPIOfferBasic" set to off.

First step to resolving is enabling SSPIOfferBasic so we can test to ensure that NTLM authentication can work given the username and password.

If the previous step enables a popup asking for your username and password and filling in that information then passes along your information to your PHP script then we know it is an issue of the browser not automatically passing along the NTLM information. If not then you have another problem that may or may not be solved by the next step.

To tell the browser that this site is an Intranet site and it is OK to send along authentication information we need to add it to the Internet Properties -> Security -> Local Intranet -> Sites -> Advanced -> Websites list. Google is your friend in accessing this window as it is different for each browser; however it is a central Windows construct so it will apply to all browsers who take advantage of its setting. In a larger corporation this can easily be pushed to all computers via Group Policy.

** Notes ** Some browser must be restarted between changes to the Internet Policy Panel (IE) others need not be restarted (Chrome); your best bet is to always restart the browser just in case.

Sometimes NTLM authentication via the popup authentication fails or for some unknown reason will ask you to authenticate multiple times and then throw an error. I do not know the source of this issue but I found that typing the username/password each time asked then simply refreshing would produce a working page. This only applies to testing prior to adding the site to the Local Intranet zone.

share|improve this answer
    
thanks for the tip. I did the change you mentionned and rebooted Apache. Refreshing my page, I don't get the popup as expected? It seems that I have a bigger problem on my hands? –  TekiusFanatikus May 4 '11 at 15:10

Try using mod_rewrite to add the supplied username (with or without) the domain like so:

# add username
RewriteEngine on
RewriteCond %{IS_SUBREQ} ^false$
RewriteCond %{LA-U:REMOTE_USER} (.+)
RewriteRule .* - [E=PROXY_USER:%{LA-U:REMOTE_USER}]
RequestHeader set Remote-User %{PROXY_USER}e

Check the headers that are being sent to PHP - I don't know the function in PHP, but there'll be some kinda "dump all the headers" callable (or combination of callables) which will show you them.

It may be that the username isn't being passed to PHP or that the header key name is different to what your PHP expects (REMOTE_USER or PHP_AUTH_USER); you can alter the PHP to suit or use mod_rewrite.

Some would advise on avoiding mod_rewrite...

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.