RE: Securing through the IIS web server domain logon

["Michael Silk" <michaels () phg com au>]

You could even get it out from the "Authorization" header if you wanted
... (but it's in base64 format and is hidden inside the NTLM structure).


-----Original Message-----
From: Thomas Chiverton [mailto:thomas.chiverton () bluefinger com] 
Sent: Thursday, 19 August 2004 1:36 AM
To: webappsec () securityfocus com
Cc: Koniszewski, Jeffrey
Subject: Re: Securing through the IIS web server domain logon

On Tuesday 17 Aug 2004 22:21 pm, you said:
> iusr access). This, as I understand it, would require the web server 
> to prompt for domain authentication.

IE will silently perform this for you, and...

> way to get the user name from the IIS domain logon? Is it accessible 
> via

... IIS will fill in (iirc) the remote_user CGI enviroment variable.

--
Tom Chiverton
Advanced ColdFusion Programmer

Tel: +44(0)1749 834997
email: tom.chiverton () bluefinger com
BlueFinger Limited
Underwood Business Park
Wookey Hole Road, WELLS. BA5 1AF
Tel: +44 (0)1749 834900
Fax: +44 (0)1749 834901
web: www.bluefinger.com
Company Reg No: 4209395 Registered Office: 2 Temple Back East, Temple
Quay, BRISTOL. BS1 6EG.
*** This E-mail contains confidential information for the addressee
only. If you are not the intended recipient, please notify us
immediately. You should not use, disclose, distribute or copy this
communication if received in error. No binding contract will result from
this e-mail until such time as a written document is signed on behalf of
the company. BlueFinger Limited cannot accept responsibility for the
completeness or accuracy of this message as it has been transmitted over
public networks.***



This email message and accompanying data may contain information that is confidential and/or subject to legal 
privilege. If you are not the intended recipient, you are notified that any use, dissemination, distribution or copying 
of this message or data is prohibited. If you have received this email message in error, please notify us immediately 
and erase all copies of this message and attachments.

This email is for your convenience only, you should not rely on any information contained herein for contractual or 
legal purposes. You should only rely on information and/or instructions in writing and on company letterhead signed by 
authorised persons.