PHP on IIS with basic authentication

[Joff]

I'm running PHP on IIS and need to set basic authentication on a
particular folder, e.g http://domain.com/private/
I've set the user on the server and assigned permissions to the
folder.

When requesting files within the folder, I get the login/password
prompt and entering the correct credentials gives me the file, except
for .php files.

The .php file is as basic as they come with just <?php echo "Hello
world"; ?as the contents.

http://domain.com/private/test.txt works perfectly, however
http://domain.com/private/test.php denies access, giving only:
"Unauthorized
Access is denied due to invalid credentials."

I've tried giving the user full permissions; I've ensured that
Application Settings configuration within IIS Manager properties >
Home Directory, allows PHP files.
Any other suggestions?

[Heiko Richler]

Joff wrote:

I'm running PHP on IIS and need to set basic authentication on a
particular folder, e.g http://domain.com/private/
I've set the user on the server and assigned permissions to the
folder.

When requesting files within the folder, I get the login/password
prompt and entering the correct credentials gives me the file, except
for .php files.

The .php file is as basic as they come with just <?php echo "Hello
world"; ?as the contents.

http://domain.com/private/test.txt works perfectly, however
http://domain.com/private/test.php denies access, giving only:
"Unauthorized
Access is denied due to invalid credentials."

I've tried giving the user full permissions; I've ensured that
Application Settings configuration within IIS Manager properties >
Home Directory, allows PHP files.
Any other suggestions?

What you describe sounds like windows integrated authentication not like
basic authentication. In this cases the user login on needs access to
the file on the server. If it is what you mean, the user may even need
the rights to execute that .php file as well as the right to execute php
itself.

Heiko

[Joff]

In that case it might be my understanding of IIS basic authentication
and how it (should) works.

This is what I'm currently doing:

IIS Manager domain.com - private folder properties Directory
Security Authentication and access control - Edit
Unchecked "Enable anonymous access"
Checked only "Basic authentication (password is sent in clear text)"

Then to assign the user:

IIS Manager domain.com - private folder permissions Assign full
control to "test" user
(I'm assigning full control at present to try and establish where the
problem lies)

[Jerry Stuckle]

Joff wrote:

In that case it might be my understanding of IIS basic authentication
and how it (should) works.

This is what I'm currently doing:

IIS Manager domain.com - private folder properties Directory
Security Authentication and access control - Edit
Unchecked "Enable anonymous access"
Checked only "Basic authentication (password is sent in clear text)"

Then to assign the user:

IIS Manager domain.com - private folder permissions Assign full
control to "test" user
(I'm assigning full control at present to try and establish where the
problem lies)

Are you running PHP as a CGI or a isapi module?

--
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
js*******@attglobal.net
==================

[Joff]

On Aug 2, 6:21 pm, Jerry Stuckle <[e-mail]:

Are you running PHP as a CGI or a isapi module?

Embarrassingly, I don't know. It's a Windows 2k3 VPS running Plesk/
Virtuozzo if that helps to narrow it down? Is there any way to check?

[Jerry Stuckle]

Joff wrote:

On Aug 2, 6:21 pm, Jerry Stuckle <[e-mail]:

>Are you running PHP as a CGI or a isapi module?

Embarrassingly, I don't know. It's a Windows 2k3 VPS running Plesk/
Virtuozzo if that helps to narrow it down? Is there any way to check?

Sorry, no. I don't use Plesk/Virtuozo so I have no idea. The only
Windows sites I have are VPS's.

The reason I'm asking - if you're running PHP as a CGI, chances are you
need to set permissions on the php.exe file itself for this user.

If you're running as an ASPI file, it should work.

But I don't guarantee that - I'm definitely not an expert on IIS and
Windows security. Normally I run as an isapi, which works well. I have
the PHP DLL set to be readable and executable by everyone.
--
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
js*******@attglobal.net
==================

[Jerry Stuckle]

Jerry Stuckle wrote:

Joff wrote:

>On Aug 2, 6:21 pm, Jerry Stuckle <[e-mail]:

>>Are you running PHP as a CGI or a isapi module?

Embarrassingly, I don't know. It's a Windows 2k3 VPS running Plesk/
Virtuozzo if that helps to narrow it down? Is there any way to check?

Sorry, no. I don't use Plesk/Virtuozo so I have no idea. The only
Windows sites I have are VPS's.

The reason I'm asking - if you're running PHP as a CGI, chances are you
need to set permissions on the php.exe file itself for this user.

If you're running as an ASPI file, it should work.

That should be ISAPI. Sorry.

But I don't guarantee that - I'm definitely not an expert on IIS and
Windows security. Normally I run as an isapi, which works well. I have
the PHP DLL set to be readable and executable by everyone.

--
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
js*******@attglobal.net
==================

[Joff]

Cheers Jerry,

I have remote access to the VPS too (I just mentioned Plesk/Virtuozzo
incase that helped identify the type of PHP installation).

How do I check to see whether mine's CGI or ISAPI? Is it just a case
of looking at the running services?

[Joff]

I've had a dig around and within the Mappings tab (Internet Services
Manager Web Site Home Directory Configure) I've found that .php
and .php3 files are mapped to php-cgi.exe

[Joff]

On Aug 3, 9:07 am, Joff <[e-mail]:

I've had a dig around and within the Mappings tab (Internet Services
Manager Web Site Home Directory Configure) I've found that .php
and .php3 files are mapped to php-cgi.exe

Further to the above.

If I set the test user with full permissions to php-cgi.exe, then
requesting within the /private folder .php files now give a "Internal
Server Error" message.

[Jerry Stuckle]

Joff wrote:

On Aug 3, 9:07 am, Joff <[e-mail]:

>I've had a dig around and within the Mappings tab (Internet Services
Manager Web Site Home Directory Configure) I've found that .php
and .php3 files are mapped to php-cgi.exe

Further to the above.

If I set the test user with full permissions to php-cgi.exe, then
requesting within the /private folder .php files now give a "Internal
Server Error" message.

You also need to ensure your php.ini file and all dll's loaded have the
appropriate permissions. Basically anything which PHP might load.

BTW - I normally run PHP as an isapi. It's more efficient and
integrates better.

--
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
js*******@attglobal.net
==================

[Joff]

On Aug 3, 12:38 pm, Jerry Stuckle <[e-mail]:

You also need to ensure your php.ini file and all dll's loaded have the
appropriate permissions. Basically anything which PHP might load.

Thanks, I'll go through and check them all.

BTW - I normally run PHP as an isapi. It's more efficient and
integrates better.

How do I switch over to ISAPI from the current set up?

[Jerry Stuckle]

Joff wrote:

On Aug 3, 12:38 pm, Jerry Stuckle <[e-mail]:

>You also need to ensure your php.ini file and all dll's loaded have the
appropriate permissions. Basically anything which PHP might load.

Thanks, I'll go through and check them all.

>BTW - I normally run PHP as an isapi. It's more efficient and
integrates better.

How do I switch over to ISAPI from the current set up?

<http://www.google.com/search?hl=en&client=firefox-a&rls=org.mozilla%3Aen-US%3Aofficial&hs=0uj&q=php+isapi&btnG=Search>

--
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
js*******@attglobal.net
==================