使用cURL在不同主机上对当前用户进行PHP NTLM身份验证失败
[英]PHP NTLM authentication of current user on different host fails using cURL
问题描述
I'm using PHP 7.1.7 with cURL 7.54.1 on one of the servers on the local network, and due to the development requirements, I have to be able to access files stored on another local network server (PHP 4.3 or some such). 
我在本地网络中的一台服务器上使用PHP 7.1.7和cURL 7.54.1，并且由于开发要求，我必须能够访问存储在另一台本地网络服务器上的文件（PHP 4.3或类似的文件） ）。 Due to version requirements of some of the other components of my system, I have to keep the script on the newer server, and files it accesses on the older one. 由于我系统中其他某些组件的版本要求，我必须将脚本保留在较新的服务器上，并将其访问的文件保存在较旧的服务器上。 I use the following settings to pass the current NTLM user credentials from source server where this script resides to the destination server - and it's supposed to work, but somehow it doesn't: 我使用以下设置将当前NTLM用户凭据从该脚本所在的源服务器传递到目标服务器-应该可以运行，但不成功：
function file_get_contents_curl($url) {
$curl = curl_init();
curl_setopt($curl, CURLOPT_URL, $url);
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($curl, CURLOPT_HTTPAUTH, CURLAUTH_NTLM);
curl_setopt($curl, CURLOPT_UNRESTRICTED_AUTH, TRUE);
curl_setopt($curl, CURLOPT_USERPWD, ":");
$data = curl_exec($curl);
curl_close($curl);
return $data;
}
header("Pragma: public");
header("Expires: -1");
header("Cache-Control: public, must-revalidate, post-check=0, pre-check=0");
header('Content-Type: '.get_mime_type($fileresult['filename']));
header('Content-Disposition: attachment; filename="'.$fileresult['originalname'].'"');
$contents = file_get_contents_curl($path);
$localSize = strlen($contents);
header('Content-Length: ' . $localSize);
echo $contents;
ob_flush();
flush();
exit();
When I'm explicitly specifying my 当我明确指定我的
curl_setopt($curl, CURLOPT_USERPWD, "[username]:[password]");
, it works flawlessly, but when trying to re-use existing user credentials - it fails. ，它可以完美地运行，但是当尝试重用现有的用户凭据时会失败。 As an admin, I don't want to leave my credentials in the code as plain text - that's blatant security violation, and creating dummy user profile with access rights to those files would prevent the proper logging of actual user activity on the older server - which is a security concern in itself. 作为管理员，我不想将我的凭据以纯文本形式保留在代码中-这是公然的安全违规行为，并且创建对这些文件具有访问权限的虚拟用户个人资料会阻止在旧服务器上正确记录实际的用户活动-这本身就是安全问题。
I found this bug report https://bugs.php.net/bug.php?id=62195 for the same issue, but it was related to completely different version of PHP (5.4.3), and I did take into consideration the developer's comments there - still no use. 我发现此bug报告https://bugs.php.net/bug.php?id=62195涉及同一问题，但它与完全不同的PHP版本（5.4.3）有关，我确实考虑了开发人员的评论-仍然没有用。
Is there any curl_setopt setting that I am forgetting to set properly to make it work? 有没有我忘记正确设置的curl_setopt设置才能起作用？ Perhaps IIS server may need a certain config change to allow PHP to re-use those credentials in cURL request? 也许IIS服务器可能需要进行某些配置更改，以允许PHP在cURL请求中重新使用这些凭据？ Or should it work as it currently is, and my next step would be to submit a bug report to php.net? 还是应该按目前的方式工作，而我的下一步就是向php.net提交错误报告？
Appreciate your help! 感谢您的帮助！
Edit: 编辑：
No matter which file I request using the code above (with inherited username and password), the script returns a 1.3k file with the expected file name and extension (.PDF, .PNG or any other), but containing exactly the following: 无论我使用上面的代码请求了哪个文件（带有继承的用户名和密码），该脚本都会返回一个1.3k文件，并带有预期的文件名和扩展名（.PDF，.PNG或任何其他文件），但包含的内容完全如下：
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/>
<title>401 - Unauthorized: Access is denied due to invalid credentials.</title>
<style type="text/css">
<!--
body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}
fieldset{padding:0 15px 10px 15px;}
h1{font-size:2.4em;margin:0;color:#FFF;}
h2{font-size:1.7em;margin:0;color:#CC0000;}
h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;}
#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;
background-color:#555555;}
#content{margin:0 0 0 2%;position:relative;}
.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}
-->
</style>
</head>
<body>
<div id="header"><h1>Server Error</h1></div>
<div id="content">
<div class="content-container"><fieldset>
<h2>401 - Unauthorized: Access is denied due to invalid credentials.</h2>
<h3>You do not have permission to view this directory or page using the credentials that you supplied.</h3>
</fieldset></div>
</div>
</body>
</html>
cURL returns no error - according to it everything is perfectly fine. cURL不返回错误-根据它，一切都很好。 When I'm explicitly specifying username and password all the returned files have their own expected unique size and contents. 当我明确指定用户名和密码时，所有返回的文件都有其自己预期的唯一大小和内容。
1 个解决方案
解决方案1
0 2018-07-12 23:31:55
and it's supposed to work, but somehow it doesn't
No, it's not supposed to work for different servers, as explained in the comments. 不，如注释中所述，它不应该适用于其他服务器。
To avoid authenticating twice, which could a bit difficult to implement, and not desirable for the end-user, I have the following idea. 为了避免进行两次身份验证（这可能难以实现，并且对于最终用户而言不理想），我有以下想法。
Maybe can you just rely on authenticating on the second server (PHP 4) only, the first server (PHP 7) not configured for asking credentials but forwarding the NTLM messages to the second server and then starting a session (cookie) when it knows the user has finally succeeded to authenticate. 也许您可以仅依靠第二台服务器（PHP 4）上的身份验证，第一台服务器（PHP 7）未配置为询问凭据，而是将NTLM消息转发到第二台服务器，然后在知道第二台服务器时启动会话（cookie）用户终于成功进行了身份验证。 One side-effect is that all new sessions would start by forwarding a request to the second server. 副作用是，所有新会话都将通过将请求转发到第二台服务器来开始。 Probably you can do all that in PHP, but I didn't try myself and it costs too much time unfortunately. 也许您可以用PHP来完成所有这些工作，但是我没有亲自尝试，不幸的是，这花费了太多时间。
声明:本站的技术帖子网页，遵循CC BY-SA 4.0协议，如果您需要转载，请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.