Re: Capturing Windows Login Name

Manuel Lemos wrote:
Hello,

on 02/03/2008 04:20 PM Jerry Stuckle said the following:
I know it is not possible to get Windows login name using PHP
because
it is a server-side script, but I dunno whether anyone has tried
using
This is not accurate, the Windows logon name is passed to servers by
several browsers (not just IE) when servers ask for Windows NTLM
authentication.

You just need to configure your Web server to require Windows
authentication, and you get the current logged user logon name using
GetEnv('LOGON_USER'); .

Forget Javascript, it would never work.

And which browsers are these? I want to ensure they are never
installed
on my system. Such operation would be a tremendous breach of
security.
Internet Explorer and Firefox support NTLM. Maybe other browser

NTLM is an authentication protocol. The client (the browser) does not
send passwords to the server. There is nothing insecure about this. The
browsers just send the hashed passwords to the server. The server just
compares hashes and tells if what the browser sent was correct.

Wrong. Access to my computer consists of logon id plus password. It is
none of your business what my logon id is. And it is a security
exposure.
You are missing the point. I am not arguing with you. I am telling you
how it works. NTLM is an authentication protocol that is used in
Intranets, not in the general Internet.

If you access an Intranet Web server that requires that you have
authorization in the Windows network, you have to authenticate. If your
browser supports NTLM, it will use it, otherwise it usally falls back to
Basic authentication which is not very secure because passwords are sent
unencrypted.

NTLM is a more secure authentication protocol than Basic because
passwords are never sent to the server and it saves the users from the
annoyance of typing their user names and passwords again.

I am well aware of how it works because I implemented the SASL PHP
library, that among other protocols supports NTLM.

http://www.phpclasses.org/sasl

So what? I'm quite aware how it works, also.

It is used by HTTP, POP3, SMTP client classes to access servers of these
protocols under Intranets that require NTLM authentication:

http://www.phpclasses.org/httpclient

http://www.phpclasses.org/pop3class

http://www.phpclasses.org/smtpclass

Gee, more of your lame classes?

I have an hard time understanding why you need to be so hostile and
depart to personal insult against a person that did nothing against you.

I just presented examples on which NTLM authentication is used. I do not
use Windows. I just use Linux, but I studied NTLM and other
authentication protocols in depth to add support to them by request of
the users of those classes.

It is not really relevant, but those classes are quite popular and well
rated as you may check in Freshmeat. Regardless of what you think, they
address needs of many tens of thousands of PHP developers.


And there are thousands of programmers who depend on register_globals, short_open_tags and insecure formmail scripts. Popularity does not indicate quality.

Seeing you calling them lame, I assume that you either do not know the
classes and/or just want again to turn a pure technical thread into a
personal attack full of free insults from your part.


You're the one who brought them up as examples of your "proficiency". You don't like my opinion of them? Guess what. Tough tootsies.

Anyway, if trying to insult me is your intention, nevermind, I am not
going to follow-up. If you insist with the insulting tone, rest assured
that I will leave you talking to the walls.




If the authentication succeeds, the server allows the access of
whatever
page (including PHP scripts).

This is a multi-step protocol. The user name is only passed to the
server in the last step, if the previous steps succeed.

The idea is to not make the user enter the same password again to
access
a site under the same Windows controller domain, after he has logon on
his Windows machine account that belongs to the same Windows domain.

But it cannot be done by any website to any computer with no control by
the user.
I never said it could.


You intimated that any browser would pass along your logon name to any
website which requested it. And I'm saying this is NOT the case.

No, if you read me again you may notice that I explained "This is a
multi-step protocol. The user name is only passed to the server in the
last step, if the previous steps succeed."


That's correct. But you never iterated exactly what those steps are, did you. Leaving people to assume that they can get the logon id from any system.


If you're so well aware of how it works, you need to learn to express
yourself better.

Or maybe you need to "put that gun down" and start reading properly to
what people are saying and not make wrong assumptions and departing to
personal insult.


No, I read exactly what you SAID.

And again - no PERSONAL insult. You brought up some work as examples of your "expertise". I stated my opinions of the same.

--
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@xxxxxxxxxxxxx
==================

.

Relevant Pages

  • Re: Integrated Windows Authentication Timeout?
    ... Do you see anything different for the NTLM requests? ... You might consider enabling protocol transition authentication since you are ... Joe Kaplan-MS MVP Directory Services Programming ... server. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Integrated Windows Authentication Timeout?
    ... Is it possible that a different host name is being used for one of the subsequent requests that would break Kerberos auth? ... If you have "Negotiate" authentication set in the metabase, then this can still negotiate down to NTLM if for some reason the protocol thinks that Kerberos is unavailable. ... server. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Is NTLM Authentication very expensive? (for bandwidth)
    ... When Internet Explorer has established a connection with the server by ... especially not when you use NTLM authentication. ... NTLM uses a permanant channel. ... > server sends 3827 bytes to the client. ...
    (microsoft.public.inetserver.iis.security)
  • SSPI/NTLM between native code and managed code fails for Windows 2
    ... I have an appliction that uses C++/CLI code for the client side of an NTLM ... The server and client code run on different machines and use TCP/IP to throw ... the "token" back and forth until authentication occurs. ...
    (microsoft.public.platformsdk.security)
  • Re: Error: HTTP/1.1 407 Proxy Authentication Required
    ... It appears that the tool supports server auth, ... Scan through their FAQ and see what they say about proxy authentication. ... It has some built in http tests that supports NTLM ...
    (microsoft.public.isa)