password protecting using php on Windows server

[John Lyons]

Can anyone clearly explain the steps involved in using PHP to implement basic http authentication on a NT server running IIS4?

What I am after is just getting the default browser user/password box to display and then have users log in with a username/password that I set as variables via PHP. Is this possible? I know that not allowing  anonymous login and using a simple PHP script that sends a 401 header I can get the dialog box to display, but how do I
authenticate against my PHP variables?

anyone have any tips about this?  ???

Thanks in advance.

regards,
swissLyons

[Flash-db]

I have no idea how to do this on IIS - On apache it's a relatively simple feat, But I'm lost on IIS.  I'll try to get someone with a background in IIS to answer this.

[John Lyons]

thanks Jeff,
yeah I did a bit of research last week, only to find that (naturally) there is not much out there concerning PHP and Windows  ...I see how to do it on Apache with .htaccess. Lokks simple, but I played around on our NT server trying to get a PHP script to pop open the default auth window....not much sucess. I know how configure IIS to do this, thats pretty simple, but its not a very optimal way to go about it.

anyhow, just wondering.....its not life threatening or even important really

Cheers,
john

[Musicman]

Hi,

go to www.php.net to read up the details - there is a lengthy discussion, including peculiars of windows server)
The basic strategy is to have php send a 401 header to force login.

Musicman

[John Lyons]

HI and thanks Musicman, I have already done quite a bit of reading and testing scripts that do that, i understand the process. Script sends header, window opens, enter user/pass, then the authentication happens. Problem is that when I tried a few different scripts, I could not sem to grab the value of $PHP_AUTH_USER.

[Musicman]

Hi,

the php_auth_user is there if the _server_ authenticated via a password mechanism. If you do authenticate yourself, you have to pick up the auth string. I recall an example using get_all_headers() for that

Musicman