Posted by Jerry Stuckle on 11/07/07 00:59

zdzisio wrote:
> Jerry Stuckle pisze:
>> zdzisio wrote:
>>> Rik Wasmus pisze:
>>>
>>> http://modntlm.sourceforge.net/
>>>
>>>
>>
>> Sorry, that's a login module for Apache.
>
> ofcourse it is.
>
>
>> It tells you who logged into Apache, not who's currently logged into
>> the machine.
>
> I can imagine situation when this two values differ. but so what?
>
>> And the same is true with IIS. This is not necessarily the same as
>> the person logged into the machine.
>
> I can imagine situation when this two values differ. but so what?
>

Because he specifically asked for the name of the user logged into the
client machine, not the server.

In my case, the login I use on my network is different than ANY login I
use on the internet.

> of course you can try and log out and then log in as different user than
> YOUR login to corporate network.
>
> but question was about displaing courent user of a local machine
> on web when the local machine is corporate network
>

Exactly.

> to do that you have to force automatic single sign on authentication to
> intranet web . what don't you understand?
>

No, you don't. An ActiveX control will work find for it. No login to
the server is necessary. What don't you understand?

>> Rik is correct. There is no way to get the name of the user logged
>> into the machine without ActiveX controls.
>
>
> HTTP server sends request for NTLM authentication and Windows
> workstation sends the sid back as a response. then you have to check the
> sid in Active Directory (or other LDAP server ) and youre done. this is
> that simple. no need to deny
>

That is one way to do it. But it requires the server to have access to
an LDAP server. That's not always the case. And even if it did, it may
not have access to the SAME LDAP server as the client machine - as is
not at all unusual in a large corporate intranet.

>
>> HTTP security prohibits the server from knowing such information -
>> which is a good thing.
>
> That's exactly the reason to use NTLM authentication not HTTP
> authentication.
>

And it isn't what he asked for.

You should learn to read what was asked for, not what you think he
should be doing. In this case they are two entirely different things.

>
>
> z.
>


--
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

[Back to original message]