NT User Login Capture

Paul,

Login to a website and call the function phpinfo(); in a script. When you find your username in the output you will also find the variable that has your value in it. If not it is not stored in the server vars of your php.

--
Greetz,
Robert, The Netherlands.

Something you could try is adding a line to the NT login script which creates an environment variable with their name.

SET WHOAMI=%USERNAME%

or something similar.

Then, you could use $_ENV['WHOAMI'];

Not very secure, but you could put an encrypted output for the name.

huh ?!?

I thought $_ENV[] was server-side ?

Doh!

Of course!

Erm.

He he!

PHP does not support NTLM authentication. ASP does, Java does, Perl does, Python does, but PHP don't =)

However you might try this:

<?php
echo "Your username is: ".$_SERVER["AUTH_USER"];
echo "<br>";
echo "The authentication type is: ".$_SERVER["AUTH_TYPE"];
echo "The digest of your password is: ".$_SERVER["HTTP_AUTHORIZATION"];
echo "<br>";
echo "The username of the server user is: ".$_SERVER["LOGON_USER"];
?>

This will only work under IIS, for Apache you will need to install a additional module (mod_ntlm).

PHP does not support NTLM authentication. ASP does, Java does, Perl does, Python does, but PHP don't =)

However you might try this:

<?php
echo "Your username is: ".$_SERVER["AUTH_USER"];
echo "<br>";
echo "The authentication type is: ".$_SERVER["AUTH_TYPE"];
echo "The digest of your password is: ".$_SERVER["HTTP_AUTHORIZATION"];
echo "<br>";
echo "The username of the server user is: ".$_SERVER["LOGON_USER"];
?>

This will only work under IIS, for Apache you will need to install a additional module (mod_ntlm).

So techically NTLM authentication "is" possible with PHP assuming

A) you run it on a NT/2000/.NET box,

B) IIS is used.

well, there is also the solution of using the HTTP Basic Authentication, or to use cookies...

OR (and this is the best solution), and BECAUSE you know that your customers willcome from a soecific network (so that you've their NT login, for example an Intranet) :
-give each and every client (for example free or automatic download on some index.html page of your site) a small program that runs in the background on their NT box and sends NT auth data along with @IP to the server, thus enabling him to "recognize" the people being connected from the $REMOTE_ADDR afterwards.
At least that's what I would do if I were you 8-)

hack hack hack hack

wonderful 8-)

So it works ? :D
How amazing :D
It wouldn't work for my machine, I closed those silly ports 8-)

Of course it works, and it's not a hack, it's just netbios that works this way.
special thanks to snort (http://www.snort.org :)

psadac,

so how can i use this?

I want to look at the user name and set it to a varialbe then do a few if/then  statements with the variable

How do i set the user name to a variable?