Re: Capturing Windows Login Name

Manuel Lemos wrote:
Hello,

on 02/03/2008 12:33 PM Jerry Stuckle said the following:
I know it is not possible to get Windows login name using PHP because
it is a server-side script, but I dunno whether anyone has tried using
This is not accurate, the Windows logon name is passed to servers by
several browsers (not just IE) when servers ask for Windows NTLM
authentication.

You just need to configure your Web server to require Windows
authentication, and you get the current logged user logon name using
GetEnv('LOGON_USER'); .

Forget Javascript, it would never work.

And which browsers are these? I want to ensure they are never installed
on my system. Such operation would be a tremendous breach of security.
Internet Explorer and Firefox support NTLM. Maybe other browser

NTLM is an authentication protocol. The client (the browser) does not
send passwords to the server. There is nothing insecure about this. The
browsers just send the hashed passwords to the server. The server just
compares hashes and tells if what the browser sent was correct.

Wrong. Access to my computer consists of logon id plus password. It is
none of your business what my logon id is. And it is a security exposure.

You are missing the point. I am not arguing with you. I am telling you
how it works. NTLM is an authentication protocol that is used in
Intranets, not in the general Internet.

If you access an Intranet Web server that requires that you have
authorization in the Windows network, you have to authenticate. If your
browser supports NTLM, it will use it, otherwise it usally falls back to
Basic authentication which is not very secure because passwords are sent
unencrypted.

NTLM is a more secure authentication protocol than Basic because
passwords are never sent to the server and it saves the users from the
annoyance of typing their user names and passwords again.

I am well aware of how it works because I implemented the SASL PHP
library, that among other protocols supports NTLM.

http://www.phpclasses.org/sasl


So what? I'm quite aware how it works, also.

It is used by HTTP, POP3, SMTP client classes to access servers of these
protocols under Intranets that require NTLM authentication:

http://www.phpclasses.org/httpclient

http://www.phpclasses.org/pop3class

http://www.phpclasses.org/smtpclass


Gee, more of your lame classes?


If the authentication succeeds, the server allows the access of whatever
page (including PHP scripts).

This is a multi-step protocol. The user name is only passed to the
server in the last step, if the previous steps succeed.

The idea is to not make the user enter the same password again to access
a site under the same Windows controller domain, after he has logon on
his Windows machine account that belongs to the same Windows domain.

But it cannot be done by any website to any computer with no control by
the user.

I never said it could.



You intimated that any browser would pass along your logon name to any website which requested it. And I'm saying this is NOT the case.

If you're so well aware of how it works, you need to learn to express yourself better.

--
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@xxxxxxxxxxxxx
==================

.

Relevant Pages

  • Re: Integrated Windows Authentication Timeout?
    ... Do you see anything different for the NTLM requests? ... You might consider enabling protocol transition authentication since you are ... Joe Kaplan-MS MVP Directory Services Programming ... server. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Integrated Windows Authentication Timeout?
    ... Is it possible that a different host name is being used for one of the subsequent requests that would break Kerberos auth? ... If you have "Negotiate" authentication set in the metabase, then this can still negotiate down to NTLM if for some reason the protocol thinks that Kerberos is unavailable. ... server. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Is NTLM Authentication very expensive? (for bandwidth)
    ... When Internet Explorer has established a connection with the server by ... especially not when you use NTLM authentication. ... NTLM uses a permanant channel. ... > server sends 3827 bytes to the client. ...
    (microsoft.public.inetserver.iis.security)
  • Re: LOGON_USER lifetime using NTLM
    ... NTLM authentication persists as long as the original authenticated ... send requests to the server. ... the browser will re-negotiate the authentication on its own ...
    (microsoft.public.inetserver.iis)
  • SSPI/NTLM between native code and managed code fails for Windows 2
    ... I have an appliction that uses C++/CLI code for the client side of an NTLM ... The server and client code run on different machines and use TCP/IP to throw ... the "token" back and forth until authentication occurs. ...
    (microsoft.public.platformsdk.security)
Loading