Domain user problem about msphpsql

[v-mabarw]

On 2013-10-09 01:32:17 UTC, jfha73 commented:

Just to clarify, the message is not "access denied" it is "login failed for user DOMAIN\USER"

[v-mabarw]

On 2013-10-22 23:44:32 UTC, icosahedron commented:

Interesting. Can you show the exact PHP line? I'm wondering if it might require double backslashes?

Jay

[v-mabarw]

On 2013-10-22 23:44:53 UTC, icosahedron commented:

Also, can you connect to the database from SSMS or sqlcmd?

[v-mabarw]

On 2013-10-23 03:44:28 UTC, jfha73 commented:

This is what I have to test connection:

$_POST['dbName'], "UID"=>$_POST['username'], "PWD"=>$_POST['password'] ); $conn = sqlsrv_connect( $serverName, $connectionInfo); if( $conn ) { echo "

Connection established.

"; sqlsrv_close( $conn ); }else{ echo "

Connection could not be established.

"; die( print_r( sqlsrv_errors(), true)); } ?>

I will try with double "" and I can connect just fine using any other way to connect.

[v-mabarw]

On 2013-10-23 03:45:38 UTC, jfha73 commented:

I forgot to say it gets the variables from a form.

[v-mabarw]

On 2013-10-23 03:47:39 UTC, jfha73 commented:

I tried using DOMAIN\User and I get same error.

[v-mabarw]

On 2013-10-23 03:49:47 UTC, jfha73 commented:

DOMAIN\User (double backslash)

[v-mabarw]

On 2013-10-23 03:50:25 UTC, jfha73 commented:

weird, I put double backslash on this forum and it shows 1

[v-mabarw]

On 2013-10-23 16:07:43 UTC, robertjohnson commented:

You cannot log-in with Windows authentication using a UID and PWD. The UID and PWD are for
SQL Server credentials. Windows authentication is trusted, you don't send the UID - it gets it from your session. That's what it is.

With PHP, the Windows ID comes from the PHP instance. Why not check the forum where this has been discussed several times.

[v-mabarw]

On 2013-10-24 07:16:09 UTC, jfha73 commented:

Doesn't that depend on what Browser and Server you use?

I know Windows Authentication can be used using IIS and IE, but in my case I use Apache and Firefox, does that apply in my case?

Thanks.

[v-mabarw]

On 2013-10-24 07:23:35 UTC, jfha73 commented:

Also, how about if I want to login as another user? for example, I have 2 accounts, one that's a regular user with no admin rights to anything but my computer and a second one that has admin rights for everything in the domain, I am at my computer logged
in with my regular user account and I want to login using SQLSRV with my admin account?

It just doesn't make sense to me.

[v-mabarw]

On 2013-10-24 15:34:25 UTC, robertjohnson commented:

PHP will use the credentials that Apache starts with for trusted login. So when you call sqlsrv_connect without a UID and PWD, the connection will be attempted with most likely your computer's system account.

You could either:

add a Windows login on SQL Server for the computer's system account that Apache is starting as.
set the start-up account for Apache to the same account that has access to SQL Server.

To be honest with you I think SQL Server credentials are the better route with PHP, then you can set up as many different accounts as you want and not have login issues when you deploy to different computers.

It does make perfect sense - with trusted login there is no password exchange, which would weaken the whole process of logging in. It just isn't suited to server side processes that may need to impersonate different accounts, but don't have a built-in/secure
way to do that *.

(* if you were an experienced Windows developer you could make a COM class that impersonates another Windows user - any SQL connections you make while impersonating will use the impersonated credentials, and stay that way even after you stop impersonating -
so to connect as a different Windows user, you: impersonate... connect with trusted login... stop impersonating... use your connection. However, it defeats the purpose of trusted login, and is not very different to using SQL Server credentials).