Windows 身份验证可以与 IIS 上的 PHP 一起用于 ODBC 连接吗？
是否可以在 PHP 中使用用户 Windows 身份验证（在 iis 中设置）进行数据库连接？
在 .NET 世界中，通过一种称为“模拟”的技术可以实现这一点。 PHP/IIS 世界中也存在这种情况吗？
编辑：我使用的数据库是 MS SQL Server 2005。
Is it possible to use the users windows authentication (setting in iis) for database connections in PHP?
This is possible in the .NET world through a technique called "impersonation". Does this also exist in the PHP/IIS world?
EDIT: The Database I am using is MS SQL Server 2005.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
我知道如果您通过系统 DSN 创建 ODBC 连接，则可以提供与 ODBC 连接关联的登录名和密码。 我假设登录 un/pw 可以是 Windows 用户帐户。
这样做似乎会限制您使用预定的帐户。
可以创建一个组，添加所需的用户，用密码保护目录并仅允许组访问该目录。
你没有说你正在使用哪个数据库。 如果您使用 MS Access，我知道您可以隐藏数据库密码。 请参阅我的对另一篇文章的评论。
I know that you can supply the login name and password that you want associated with your ODBC connection if you create it through System DSN. I assume that the login un/pw can be windows user accounts.
Doing it that way seems to limit you to a predetermined account.
It might be possible to create a group, add the desired users, password protect the directory and only allow the group access to the directory.
You didn't say which database you're using though. If you are using MS Access, I know you can hide your database passwords. See my comment on another post.
您以哪种方式在 PHP 上运行 IIS？ 作为独立的 CGI 或 ISAPI？
我的首选解决方案是在 SQL Server 上有一个单独的用户进行访问，而不是尝试强制 IIS 作为模拟用户运行，这对于开发计算机来说很好，但对于以后的生产甚至登台来说就不太好了。
但是，如果您使用 FastCGI，则可以使用我记得的配置文件来模拟运行该进程的用户，该文件传递登录用户的凭据。
Which way are you running IIS on PHP? As a standalone CGI or ISAPI?
My preferred solution would be to have a separate user on SQL Server for the access, instead of trying to force the IIS to run as an impersonated a user which is fine for development machines but not so good later on for production or even staging.
But if you're using FastCGI, it is possible to impersonate a user that the process is run by with the configuration file from what I remember, which passes the user logged in's credentials.
如果您可以使用 Keberos 对 PHP 应用程序进行身份验证，则可以使用 kerberos 委派将凭据传递到辅助服务器。
Ken Schaefer 拥有一系列有关 Kerberos 的博客，包括 这篇关于授权的文章。
If you can authenticate the PHP application with Keberos, you can use kerberos Delegation to pass the credentials to the secondary server.
Ken Schaefer has a whole series of blogs on Kerberos, including this article on delegation.
通过 Kerberos 进行模拟是最安全的方法，也是最容易管理的方法。 在访问数据库等资源时拥有单独的“合成”用户意味着您基本上绕过了数据库授权的所有可能性，获得了重复的访问管理点，并且您在数据库级别获得了零可追溯性（您只是看到 MySyntheticUser 尝试访问某些内容，而不是谁是幕后黑手）。
话虽如此，我应该警告您，Microsoft 的 Kerberos 并不总是像您想象的那么简单。 我们在让它在纯 .NET 解决方案、IIS、SQL Server 2005、AD 域和 Internet Explorer 之间工作时遇到了很大的困难。 大部分原因在于正确配置信任。 另外，虽然我自己不是 PHP 开发人员，但我发现 一些迹象 您可能在访问 Kerberos 库功能时遇到问题。 了解您可以获得 SSPI 的支持。 另外，您的 PHP 进程必须具有模拟用户所需的权限，我相信这可以通过 IIS 进行管理。
我不一定期望所有这些都是直接或容易的，特别是因为微软很少有支持非微软语言和平台的举措。
Impersonation through Kerberos is the most secure answer, as well as the simplest to administrate. Having separate 'synthetic' users when accessing resources like databases means you basically bypass all possibilities for database authorization, get duplicate points of access administration, and that you get zero traceability at the database level (you just see that MySyntheticUser tried to access something, not who was behind it).
Having said this, I should warn you that Microsoft's Kerberos isn't always as straightforward as you would expect. We've had significant trouble getting it to work between pure .NET solutions, IIS, SQL Server 2005, AD domains and Internet Explorer. Most of it was down to getting trust configured exactly right. Also, while I'm not a PHP developer myself, I find some indications that you may have trouble accessing Kerberos library functionality. Find out what support you can get for SSPI. Also, your PHP process must have the necessary permissions to impersonate users, which I believe can be administered through IIS.
I would not necessarily expect all of this to be straightforward or easy, particularly as Microsoft has few incitaments to support non-Microsoft languages and platforms.
每个用户必须单独验证吗？ 如果没有，您可以将 IIS 设置为模拟一个人。
Must each user be verified separately? If not, you can set IIS to impersonate one person.