First let me say your code saved me a ton of time (Thank You!), this is just because of our implementation here at The Clinic, I am required me to use Windows (2k8R2), IIS7, MySQL, and PHP5 for our web server.
I am certain there are others out there with this requirement.
To make this work it took me a couple days to get it right, but in the end I got it to go with only a couple modifications.
Just wanted to pass the modifications along to you so you could incorporate them if you wished, or at the very least help anyone else who runs into this issue.
I put the modified files into the attached zip file, I assume you guys can figure out what I changed pretty easily. (I provided in-line documentation and the folder structure to the two files are all in the zip file)
With these modifications your plugin should work on any platform as it no longer is dependent on Apache.
Basically I manually send the 'WWW-Authenticate: NTLM' header if the $remote_user string is empty or null, before assuming authentication failure and returning null.
Please also note how I had to make it map the name out of the data structure… I assume this is because you are getting the name in a module prior to where I am interjecting my code, but Joomla cries when it tries to make the new account with out this modification.
----I know there is a more eloquent way of doing that but I was kinda pressed for time so I just parsed the output of the “print_r($response->jmapmyentry, true);” command using a preg_match_all.
----If you could make it access the “[dn:protected]” piece of the array directly it would work better.
In http.php I found that the location of your implementation for the statement:
“if(is_null($remote_user) || $remote_user=='') return null;”
fails -> if the “WWW-Authentication: NTLM” header hasn’t been sent yet.
So I did this:
Code:
public function detectRemoteUser()
{
// Get the $_SERVER key and ensure its lowercase and doesn't filter
$remote_user = strtolower(
JRequest::getVar($this->params->get('userkey','REMOTE_USER'), null, 'server', 'string', JREQUEST_ALLOWRAW)
);
//Do not allow return null here as first round in new IE / IIS
//interaction does not send credentials until you send the header below
//then you will get your authentication headers
/**************************************************************/
if(is_null($remote_user) || $remote_user=='') header('WWW-Authenticate: NTLM', false);
/**************************************************************/
// Get a username replacement parameter in lowercase and split by semi-colons
$replace_set = explode(';', strtolower($this->params->get('username_replacement','')));
foreach($replace_set as $replacement) {
$remote_user = str_replace(trim($replacement),'',$remote_user);
}
//Now if still null or empty set, then return null
//Moved here from above
/**************************************************************/
if(is_null($remote_user) || $remote_user=='') return null;
/**************************************************************/
return $remote_user;
}
(NOTE: The return null on empty conditional statement most likely could go directly after the send header on empty conditional statement to avoid parsing null.)
Let me know if you update your extension I would be interested in seeing the final implementation for this aspect of your code.
