0

I built a php intranet web application that allow users to show their information stored in Active Directory.

I want to auto authenticate the user over the Active directory using his windows credentials that he entered when he logged in to the windows, but a login pop up window appears when I access the application.

I actually prefer to auto authenticate the user, but this popup window is not a big problem. The problem happens when the user enter wrong credentials. It allows him to access the application !!

How can I auto authenticate the user ? or How can I prevent users from accessing the application when they provide wrong credentials?

note:

I am using the NTLM authentication witch is described in this article: http://siphon9.net/loune/2007/10/simple-lightweight-ntlm-in-php/

I am working on Windows 7 I am using Apatch 2.2, php5 and iis7

1
  • We don't really do programming here. And it's also a bad idea to cross-post your questions to multiple Stack Exchange sites. Dec 23, 2012 at 15:10

1 Answer 1

2

The server you're using is asking for "Basic" or "Digest" authentication first. Which is why the browser is prompting them for credentials. If that mechanism succeeds then no other will be tried. If that mechanism fails (browser doesn't support it, or the user enters the wrong credentials) then the server will try other mechanisms (like NTLM, Kerberos, whatever it supports).

It's not clear what server you're using (Apache and IIS are both mentioned), but you want to change the mechanism order so that NTLM or Kerberos (aka Negotiation) is tried first, then Digest. I would not enable Basic unless you have SSL securing the site.

From the code in the post it looks like your application itself might be handling authentication and only using the webserver as a passthrough. If that's the case the order of authentication mechanisms would be specified in your code rather than the server itself.

A side note: I and most other System Administrators hate you if your code is handling authentication itself. Web servers do a nice job of handling this and there's no reason to re-invent the wheel for every single webapp out there (there's also a significant chance you'll get something wrong; wont maintain your code over time; the list goes on). I've dealt with enough of these applications that my feelings are quite strong on this matter.

Not the answer you're looking for? Browse other questions tagged .