Windows authentication

kujo2123 · August 2, 2007, 4:39am

I had a customer of mine ask me if the authentication changed on the windows servers such that they no longer can use upper or lower case usernames. Did something recently change (I believe they are hosted on Win23)?

Stephen · August 2, 2007, 6:53am

? windows has never been case sensitive only linux

kujo2123 · August 2, 2007, 2:06pm

I just tested it and sure enough, if I had the username in all caps, it wouldn’t let me know. All lowercase and it worked just fine.

Pratik · August 2, 2007, 2:38pm

I guess you have just opened a ticket as well.

The issue here is not the server on where your site is hosted. But the database you are using. I found that you have used Mysql Database and yes mysql is case sensitive.

kujo2123 · August 2, 2007, 6:10pm

I did open a ticket as well. I have to check with the developer to see if she changed the authentication method, but after looking myself, I don’t believe she did. We have been using the protect method in the control panel interface such that you can protect a directory using the htaccess files (web shell interface). The site has always used MySQL but never talked to it for authentication which is why I’m confused on why it would be looking at it now and is therefore case sensitive.

Thanks,
-Ben

kujo2123 · August 3, 2007, 2:09am

I responded to ticket #OSX-55032-208 that it was not anything to do with MySQL. The authentication uses the webshell protect method, which is essentially htaccess. Please look into this.

Thanks,
-Ben

Pratik · August 3, 2007, 10:13am

We have two ways to password protect a directory as far as windows server is concerned where Hsphere is installed.

is directly from IIS using directory security. This way it will use windows authentication method and here the user name will not be case sensitive.
is using webshell and htprotect, here when we use this method it just uses a dll which is a part of webshell install and that controls everything for webshell. It needs PHP to run the application. Now here no where windows authentication comes in picture. So as per what I belive and what it seems that htprotect has to be case sensitive. As it was primarily written for apache. When you open the Help file in webshell it will also ultimitely lead you to apache.

I guess that is all explanation i guess i can provide as far as webshell works on windows.

kujo2123 · August 3, 2007, 1:59pm

It does not appear to have worked like that before, according to my customer. They were able to use any case for the username. Can you please explain why it seems to have changed?

Pratik · August 3, 2007, 3:07pm

send us the link where you have used htprotect and it is not case sensitive. Send the link of our server so that we can check the files created by htprotect and see what’s going on.

I have replied you in detail on the ticket however.

Stephen · August 3, 2007, 3:07pm

The only reason is that maybe psoft has changed the backend dll that does this with the webshell when they worked to makee it(but not successfully I might add) php5 ready.

kujo2123 · August 5, 2007, 4:08pm

Is there any way to find out for sure? My customer is pretty upset because of the lack of being told up front and people not being able to log into the site. I realize that good security dictates case sensitivity even in the username, but customers seldom realize what real security it. Especially given the fact that they were able to use either case in the username before, and now they can’t and weren’t told about it.

Thanks,
-Ben

Stephen · August 5, 2007, 7:15pm

There is nothing we have knowingly done that changes this, if an hpshere update did it we were NOT told, so we had no way to inform