PHP and Windows Server Authentication

Discussions of secure PHP coding. Security in software is important, so don't be afraid to ask. And when answering: be anal. Nitpick. No security vulnerability is too small.

Moderator: General Moderators

Post Reply
User avatar
dallasx
Forum Contributor
Posts: 106
Joined: Thu Oct 20, 2005 4:55 pm
Location: California

PHP and Windows Server Authentication

Post by dallasx »

Is it possible to create a login form and check the username and password against the Windows user accounts? I'm not sure if I said that right.
foobar
Forum Regular
Posts: 613
Joined: Wed Sep 28, 2005 10:08 am

Re: PHP and Windows Server Authentication

Post by foobar »

dallasx wrote:Is it possible to create a login form and check the username and password against the Windows user accounts? I'm not sure if I said that right.
No, that would go under security infringement. You could gain access the the user's machine that way.
User avatar
dallasx
Forum Contributor
Posts: 106
Joined: Thu Oct 20, 2005 4:55 pm
Location: California

Re: PHP and Windows Server Authentication

Post by dallasx »

foobar wrote:
dallasx wrote:Is it possible to create a login form and check the username and password against the Windows user accounts? I'm not sure if I said that right.
No, that would go under security infringement. You could gain access the the user's machine that way.
I mean for protecting parts of my site. Instead of having a database full of employee login information and the Windows user directory, couldn't I check for a valid account against the Windows server?

What I'm trying to do is limit my margin of error. I could overlook a terminated employee or something like that whereas the MIS department maintains the employee accounts and will delete them on the spot.

My hangover is to blame for my explanation.
User avatar
Jenk
DevNet Master
Posts: 3587
Joined: Mon Sep 19, 2005 6:24 am
Location: London

Post by Jenk »

LDAP could be of assistance.
User avatar
dallasx
Forum Contributor
Posts: 106
Joined: Thu Oct 20, 2005 4:55 pm
Location: California

Post by dallasx »

Jenk wrote:LDAP could be of assistance.
I haven't looked deeply into it but the only thing I can see is that when you entered a page, a prompt would pop up. Any way around that?
Post Reply