Well, user authentication through windows is no a good idea. I dont know if through IIS server you can get account information from a windows domain, but, my guess is that like with anything else, you cant access user password information, for instance.
The step 2 I talked about is made through a Web based interface, so It can be accesable ANYWHERE in the whole world, provided your web server has a DNS or at least an IP accesible from Internet, aka, its not only locally.
The authentication method I explained in step 2 is very very simple, and is commonly used in most contenet managemente systems, just like daniweb.
You can google for "php user authentication mysql" and get losts of tutorials on how to do it, but since Im in a good mood, Ill tell you how I do it, so, heres my quick tutorial.
1. Create a table in your database, It can be as complex as you want. The example is very simple however.
CREATE TABLE user(
id INTEGER NOT NULL auto_increment,
type INTEGER NOT NULL DEFAULT 2,
login CHAR(12) NOT NULL,
password CHAR(32) NOT NULL,
PRIMARY KEY(id)
);
You could add some more fields, such as name, address, location, sex, age, and so on...
One thing here about the passwords, those -for security sake- can be stored encrypted as a 32 character string. This is easily accomplished in mysql, check it out
//So, we receive the login and password sent via POST by the HTML form...
$login=$_POST['login'];
$password=$_POST['password'];
//Here is your SQL connection code
//The query would look something like this
phpquerymethod-whateveritis(...,"INSERT INTO user(login,password) VALUES('$login',md5('$password'))");
Thats it, then the password is stored as md5. Well look at the password comparison for the authentication later.
Now, that done, you have to make a choice here
a) Will you let your users register themselves, or
b) The admin (your boss) will be the only one allowed to do so?
In both case, we need to create now a web interface (just a simple HTML form) to create new users in the table user
2. Lets start making the authentication system.
This can be achieved in two ways, either by the $_SESSION global variable or $_COKIE global.
With the first one, you dont have to care about creating the cokie itself, its done automatically, with the second one, you can do it the simple way (just as $_SESSION) or you can also put some parameters in the cokie, like an expiration time (like in webmail servers where, after some minutes of inactivity, you are logged out) and much more.
I have never worked with cokies before, so Ill tell you how to use $_SESSION (and It will never expire by default)
Lets suposse we are gonna have 2 global session variables in all the scripts, the login for the user and the type.
Lets now pretend the type can be
1 = root (your boss perhaps?)
2 = user (authenticated user)
This is what the field "type" was put in the SQL table in point 1...
Notice, for every script youre gonna make, include the following code at the top
//Lets load the session variables
session_start();
$user_type=$_SESSION['user_type'];
$user_login=$_SESSION['user_login'];
Basically it loads a session (could be the guest session), now, depending on what you want to do with the user type and login in every script, you need to do something with those variables, so lets see the example in the next section.
3. Its time now to create the HTML form to create new users in the database. Now, lets pretend ONLY THE ROOT can enter the HTML form and submit it. If any user could do it, just take away the following code...
//File : registration.php
//Session variables code explained in last section goes here
if(isset($user_type)){ //User IS authenticated
if($user_type == 1){ //Yeah! user is the root
/*Here comes the HTML form, lets suppose you put in the action field of the form this:
registration2.php*/
}
else{
echo "You have no permission to access this page";
}
}
else //Ha! user is not even authenticated (the loaded session variables are "empty")
echo "You are not authenticated, please do so now";
As you can see, the session variables load code is not harmful in the sense that, if the user is autheticated the variables $user_type and $user_login will be set to some value, otherwise they wont be set ("guest" user)
If your boss wants to give everyone the chance to register an account, not only the admin, then the preceding code would be something like this
//File : registration.php
//Session variables code explained in last section goes here
if(isset($user_type)){ //User IS authenticated
echo "You are currently logged in as $user_login, so why are you trying to create an account?!";
}
else //Ha! user is not even authenticated (the loaded session variables are "empty")
/*Here comes the HTML form, lets suppose you put in the action field of the form this:
registration2.php*/
4. Create the user in the database. As the prior example, we said "registration2.php" would be the script receiving the variables from the HTML form, this is simple php variable pass, so I wont explain anything, other than, once you have the variables, you enter the data into the DB table user, like I explained in point 1, in the md5 part. Since the type variable is set to "2" by default, then It means all users from now on wont be given root
priviledged, and thats it.
5. Now, time to create the login script...
//File : login.php
//Session variables code explained in last section goes here
if(isset($user_type))
echo "You are already logged in as $user_login!";
else //User is a guest...
//Show some HTML login form, and put in the action field "login2.php
Thats it, now, the script login2.php would receive the variables, then check in the database if the given user exists, otherwise echoes an error (wrong password/login bla bla)
Now, lets suposse there IS a user in the table with the given login/password, what to do now to intialize that user's session?
//"Delete" guest user session
session_unset();
$user_type=[some variable retrieved from the database...];
$user_login=[some variable retrieved from the database...];
session_register("user_type","user_login");
header("Location: index.php"); //Lets redirect the user to the index
Now, the session_register code basically SETS the global session variables to some value... now they wont be empty anymore
6. Time for the logout script
//File : logout.php
//Session variables code explained in last section goes here
if(isset($user_type)){
session_unset();
session_destroy();
header("Location: index.php"); //Lets redirect the user to the index
}
else //User is a guest...
echo " You are a guest, you cant be logged out!?%#~@!";
And thats pretty much it, sorry for the crappy source code, but I think it serves as a nice beginners intro to what session are
Lets resume:
For every php script, load session global variables. If they are set, its because of a prior call to the method session_register (aka, the user logged in), otherwise, the user is a guest.
Cheers :mrgreen:
i'm actually server administrator but dont do ANY sort of programming, know a little about sql administration, and still learning. so this information was definitely helpfull.
Offline 
Unsolved 
