Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I built a php intranet web application that allow users to show their information stored in Active Directory.

I want to auto authenticate the user over the Active directory using his windows credentials that he entered when he logged in to the windows, but a login pop up window appears when I access the application.

I actually prefer to auto authenticate the user, but this popup window is not a big problem. The problem happens when the user enter wrong credentials. It allows him to access the application !!

How can I auto authenticate the user ? or How can I prevent users from accessing the application when they provide wrong credentials?


I am using the NTLM authentication witch is described in this article:

I am working on Windows 7 I am using Apatch 2.2, php5 and iis7

share|improve this question

closed as off topic by Michael Hampton, mdpc, Ward, Magellan, Scott Pack Dec 24 '12 at 16:40

Questions on Server Fault are expected to relate to server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

We don't really do programming here. And it's also a bad idea to cross-post your questions to multiple Stack Exchange sites. – Michael Hampton Dec 23 '12 at 15:10

The server you're using is asking for "Basic" or "Digest" authentication first. Which is why the browser is prompting them for credentials. If that mechanism succeeds then no other will be tried. If that mechanism fails (browser doesn't support it, or the user enters the wrong credentials) then the server will try other mechanisms (like NTLM, Kerberos, whatever it supports).

It's not clear what server you're using (Apache and IIS are both mentioned), but you want to change the mechanism order so that NTLM or Kerberos (aka Negotiation) is tried first, then Digest. I would not enable Basic unless you have SSL securing the site.

From the code in the post it looks like your application itself might be handling authentication and only using the webserver as a passthrough. If that's the case the order of authentication mechanisms would be specified in your code rather than the server itself.

A side note: I and most other System Administrators hate you if your code is handling authentication itself. Web servers do a nice job of handling this and there's no reason to re-invent the wheel for every single webapp out there (there's also a significant chance you'll get something wrong; wont maintain your code over time; the list goes on). I've dealt with enough of these applications that my feelings are quite strong on this matter.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.