Code Examples -> external authentication

	Submit Your Code
	SEO Monitor
	UpTime Monitor
	PHP Code Contest
	My Favorite Examples
	My Favorite Articles
	Update Your Profile

More Weber Sites
	PHP Code Search
	Web Development Forums
	Learn MySQL Playing Trivia
	PHPBB2 Templates
	Web Development Index
	PHP Web Logs (BLogs)
	Web Development Resources
	Web Development Content

Recommended Links
	PHPClasses
	PHP Editor
	PHP Jobs
	Vision.To Design
	Ajax Tutorials
	PHP Programming Help
	PHP/MySQL Programming
	Webmaster Resources
	Webmaster Forum
	XML meta language
	website builder

Recommended
	Submit Site
	Forex Trading Online forex trading platform


BACK		ADD A COMMENT		SEND TO A FRIEND		ADD TO MY FAVORITES		ADD CODE EXAMPLES		PRINT

PHP Code Examples

Title :	external authentication
Categories :	Authentication, PHP	Rasmus Lerdorf
Date :	Oct 10th 1998
Grade :	3 of 5 (graded 2 times)
Viewed :	18069
File :	No file for this code example.
Images :	No Images for this code example.

Search :	More code by Rasmus Lerdorf
Action :	Grade This Code Example
Tools :	My Examples List

Code

> In order to prevent someone from writing a script which reveals the
> password for a page that was authenticated through a traditional external
> mechanism, the PHP_AUTH variables will not be set if external authentication
> is enabled for that particular page.
> Does that mean that the database and the web server have to be on the
> same machine?

I realize you figured out your problem, but just to clarify what is meant
by "external authentication" in the documentation. As far as PHP is
concerned, any authentication not performed by PHP is external. So, if
you have mod_auth_mysql doing the authentication, for example, then you
will not have the $HTTP_AUTH_* variables set. You will have the
traditional $REMOTE_USER variable, of course, so you know who the logged
in user is, but you will not know the password. Since the password has
already been checked there is no reason for you to know it.

> My understanding of authentication it that REMOTE_USER is set whatever form
> of http authentication you use, whether it be mod_auth, mod_auth_mysql, or
> PHP (or any others there are). But PHP_AUTH_USER is only set if you are
> using PHP's http authentication hooks and even if you are using PHP's
> authentication hooks its safer to get REMOTE_USER from the environment.

Actually, took another look at the Apache-1.3 code. This is correct. If
PHP does the authentication $REMOTE_USER will be set, so my last post was
inaccurate. Still, if authentication is done outside PHP, PHP_AUTH_USER
will not be set.

Related Code Examples

	Using $PHP_AUTH_USER and $PHP_AUTH_PW to authenticate. Categories : Authentication, PHP
	Function to remember password Categories : PHP, Authentication, Personalization and Membership
	PHP4 MYSQL Authentication Script with cookie. Short & Sweet Categories : Authentication, Apache, Cookies, PHP, MySQL
	Authorize Me! An authentication script. Categories : MySQL, Databases, Authentication, PHP
	Authentication script to authenticate users in Active Directory through LDAP. Categories : LDAP, Authentication, Cookies, PHP
	MD5 secured login Categories : PHP, Java Script, Authentication, Security
	Import the yahoo address book. Categories : PHP, CURL, Authentication
	Simple and fast user authentication Categories : PHP, PHP Classes, Authentication
	Is there some possibility to link a database to an htaccess file, so that instead of having a passwd file you would have a database with DES-crypted password and username fields? Categories : Authentication, PHP, General SQL, Databases
	Authentication HTTP protocol POST Categories : Authentication, HTTP, PHP
	Full membership authentication system. Categories : Authentication, MySQL, PHP, Databases
	A simple PHP login script that you can modify to suite your needs. It use a session to store data in a session file submited by the page. Categories : PHP, Sessions, Security, Authentication
	Implementing a "Members ONLY" area Categories : PHP, MySQL, Databases, Authentication
	AUTH (.htaccess style) - a login system that uses PostgreSQL. Categories : PHP, Authentication, Databases, PostgreSQL
	Form Security - Match A Value For Success Categories : PHP, Authentication, HTML and PHP, Sessions, Security

User Comments

	Dan Roscigno wrote :118 I am having a problem with php auth not setting the $REMOTE_USER. If I use mod_mysql_auth the $REMOTE_USER gets set, but when I use php auth the logfiles show a `-` for the user. I am running php 3.0.12 and Apache 1.3.9