Find Clients Current User with ASP 4

[PsychoticBadgers]

[COLOR=red yellow]How can I make ASP show the Logon of the Current User?[/color]

My ASP runs SQL code on our server OK, and is located on my machine. This page can be accessed from other machines, but will always run from mine.

I need to be able to run the code based on the Username of the person using my ASP page, regardless of which machine they are using.

Any help appreciated!

 

[mlowe9]

If the user is authenticating to your page, you can use request.servervariables("remote_user")

Matt

 

[vbkris]

i am very confused, can u be a bit more clearer???

Known is handfull, Unknown is worldfull

 

[ChrisHirst]

Unless the users authenticate to access the website you can't get a username.

thread333-893714


Chris.

Indifference will be the downfall of mankind, but who cares?
Woo Hoo! the cobblers kids get new shoes.

http://www.cram-system.com

Nightclub counting systems

So long, and thanks for all the fish.

 

[PsychoticBadgers]

Authenticating how? If you mean logging in, then I was trying to avoid that.
These pages are a reference, and will be opened / closed regularly.

Kris, I'm trying to find the windows username of the person accessing the page.

 

[mlowe9]

I don't think you can do that. IIS cannot recognize the windows user, only the user authenticated to IIS.

I would think that would be a security risk. If it were possible, anyone could write a web page to capture your username on your local machine. Would you really want that as a user?

Plus, if they could access your username, they could probably capture other vital information, password, domain, etc. That would be BAD...

 

[Lothario]

Can you please erphrase your question and tell your requirements...

Are you looking for something like...getting the users information from ActiveDirectory or LDAP Server...

Not sure of your question...

-L

 

[PsychoticBadgers]

Point taken mlowe9, but I have seen various methods of passing this information to an ASP (like the USERNAME environment variable) I just can't get them to work.

Lothario,
I have an ASP page on my PC that other users on my network can run from links I have provided. I would like the page to react differently to certain users, and was hoping to allow the ASP to recognise who was looking at it from their windows login information.

 

[vbkris]

is this on a LAN? why not use IP addresses???

Known is handfull, Unknown is worldfull

 

[Sheco]

Make a simple page with only this code:

<%@ Language=VBScript %>
<%
For each oItem in Request.ServerVariables 
	Response.Write oItem & " = " & Request.ServerVariables(oItem) & "<BR><BR>" & vbCrLf
Next
%>

Run it and it will show you what you have to work with.

 

[Sheco]

Another trick you can do is to change the default permission in IIS so that it doesn't use IUSR_MachineName

Set the permission to allow for the DomainUsers group. Then IE will automatically send a value for the LOGON_USER header.

 

[mlowe9]

Again, I may be wrong, but...

I think that Environment variable is set on the web server, thus, you must authenticate to the web server for it to be valued. It's not a client machine username, or a local area network username.

I think Sheco (correct me if I'm wrong) is talking about changing the anonymous username to be something besides IUSR_Machinename to another user name defined by you. But then EVERY user that hits your page anonymously (I think that would be all users for what you're trying to do) will show up as that user. I don't think that's what you want either.

If you find out how to do what you're wanting to, please post it, because I'm interested to know if it can be...

Just curious, are you trying to do some kind of single-signon thing with your page?

 

[Sheco]

What I was trying to say is to remove the check in the box next to anonymous access where it uses the IUSR_MachineName account.

There is a user group called "Domain Users" so set the root folder with this permission. Everyone will be able to see it but they shouldnt have any popup as long as they are logged into the domain.

What happens underneath is that IIS sends back a "401 Unauthorized" and then the browser will automatically repeat the request but send the credentials. Then you can pull the credentials out of the Request.ServerVariables collection.

 

[mlowe9]

Did not know that. I'll have to try it... Thanks

 

[mlowe9]

Well, I'll be! You get a star just for teaching me something.

Am I correct that user's password is not available when doing this?

 

[Sheco]

Yeah I think it still shows AUTH_PASSWORD as blank even though AUTH_USER, LOGON_USER, and/or REMOTE_USER will be populated.

The value will be like: domain\username

 

[Sheco]

whoops, the separator between domain and username is a slash, not a pipe.

 

[PsychoticBadgers]

Sounds like you two have got it sorted, but I'm afraid you'll have to humour me a little more. I know very little about this IIS lark other than I need it to host ASP pages. (go on, roll your eyes, it's ok)

Can someone tell me WHERE the settings are, I can't find anonymous access, nevermind turn it off!
(I'm on Win 2000 Pro if it makes any difference)

Also, the root folder already gives read permission to "everyone

 

[ChrisHirst]

site properties -> Directory Security -> Edit...

Chris.

Indifference will be the downfall of mankind, but who cares?
Woo Hoo! the cobblers kids get new shoes.

http://www.cram-system.com

Nightclub counting systems

So long, and thanks for all the fish.

 

[PsychoticBadgers]

Sorry, I guess I should have been more clear.
I have no idea where to find any of my IIS settings / applications / whatever-else-it-has

Can somebody please tell me where to find them, starting from the desktop, maybe dumbing it all down a little?

Make what opinions you like, but I was guided through turning it on, and haven't looked at it since. Had no need to before now...