Remote_user

REMOTE_USER not being set

[webworker us]

I am working on a hidden security scheme for our intranet site. The plan is to use remote_user to get the windows login of the user, then compare that to a database with their permissions. However, remote_user appears to not be set. It is possible I am doing it incorrectly and was hoping for a comment or suggestion.

Thanks

Casey

hold = Request.ServerVariables("REMOTE_USER")

[CaseyRyan]

Confirm that you are not allowing Anonymous Access for the website. If this is checked, then no Remote_User header will be populated.

-=casey=-

[webworker us]

I'm using Baby Web Server, so I'm not exactly sure how to make sure it isn't anonymous login. I have asked the author, but am still waiting for a response. Do you know of any other way to get the user's login (or anything specific to them) to the server?

Thanks

Casey

[mrMister]

Baby Web Server is not a Microsoft product, you're asking this in the wrong forum. I'd suggest asking your support vendor whether Baby ASP supports the features you require.

IP address is the usual unique identifier to use on Intranets without using authentication.

As has been mentioned before, you have to use authentication before you can use REMOTE_USER. This is a security consideration, you wouldn't want every web site you visit to know the user name of your machine account.

[webworker us]

I'm asking from the ASP point of view. I have asked my vendor, and have been told that it does support the remote_user variable. I'm still waiting for the response about removing the anonymous browsing.

Our IPs are dynamic, so I couldn't specify one for each user to set their security.

[mrMister]

>Our IPs are dynamic, so I couldn't specify one for each user to set their security.

Then you need to authenticate the user some other way in order to authorize them.

If you were using IIS, then Windows Authentication would probably be the best route. If Baby ASP supports that then go with that.

Otherwise use Basic HTTP authentication. You will need to ensure each user has an account on your windows domain or web server and that they have read permissions on your Intranet folders. You will also need to disable anoymous access to your web server, which will prevent the users from bypassing the authentication process.