PHP5 and $_SERVER['REMOTE_USER']

[dreamaz]

I have a page which allows editing from users, i'm trying to prepend the test with $_SERVER['REMOTE_USER'] to display the user's domain account (to better identify who put the update there)

I get no results when i use that variable, when i try with REMOTE_ADDR i can see the IP address.

Checked phpinfo() and i don't even see REMOTE_USER, is there something im doing wrong?

there is no login to this site, open to everyone..

 

[preachie]

The webpage must be secured by the webserver (IIS/Apache, whatever), otherwise REMOTE_USER never will be populated.

 

[dreamaz]

Any other ways of getting this info? the web server is just a LAMP box on my desk which i use to serve the team

 

[darrellblackhawk]

Nope, there's nothing you're doing wrong. REMOTE_USER is not a reliable variable to use - most of the time it's empty.

You'll have to find another way - like a login/authentication scheme.

As preachie stated, your page has to be secured; as in userid and password.

 

[jpadie]

@OP there may be other ways, yes. but it's not straightforward and only works on LANs.

i believe it is possible to use the remote address of the browser in an arp query to obtain the MAC. then you can use an LDAP query on the MAC to obtain the currently associated user name.

it may also be possible to do an LDAP query based solely on the IP address of the remote user.

note that this will not authenticate a user. it will just tell you which user is logged on at the box.

 

[DonQuichote]

There is no user name without a login. It is that simple. At a former employer, some of their intranet pages contained an activex control that read that info from the PC.

If you inform the users and keep this in a private environment, this is acceptable. Otherwise, it is just spyware.

The HTTP protocol contains ways to log in. This is what yields the username in PHP. There is no link between submitted logins or PC logins, thank goodness. If websites could see your system credentials, hacking your PC would become so much easier!


+++ Despite being wrong in every important aspect, that is a very good analogy +++
Hex (in Darwin's Watch)

 

[jpadie]

@DonQuichote

there is a login to the domain controller. i believe that this can be obtained in the manner I suggest.