基于Apache、PHP&MySQL的Windows域本地网站，如何获取当前执行脚本的域用户名？

Hey there, let's figure out how to grab the current Windows domain username for your PHP scripts running on Apache in a domain environment. I've worked through this exact scenario before, so here's a step-by-step breakdown that should get you sorted:

You'll need two core Apache modules to handle Windows domain authentication. Open your httpd.conf file and make sure these lines are uncommented (remove the # at the start if they're commented out):

LoadModule authnz_winnt_module modules/mod_authnz_winnt.so
LoadModule authz_core_module modules/mod_authz_core.so

If you want seamless, passwordless authentication (no login prompt popping up for users), also enable the negotiate module:

LoadModule auth_negotiate_module modules/mod_auth_negotiate.so

Update your Apache site configuration (either in httpd.conf or a dedicated virtual host .conf file) to require domain auth for your PHP script directory. Here are two options based on your needs:

Option A: Seamless Integrated Authentication (No Login Prompt) #

This uses Kerberos/Negotiate to automatically pass the user's domain credentials from their browser (works best if users are on domain-joined machines):

<Directory "C:/path/to/your/php/scripts">
    AuthName "Windows Domain Authentication"
    AuthType Negotiate
    Require valid-user
</Directory>

Option B: Basic Authentication (Login Prompt Fallback) #

If seamless auth isn't feasible (e.g., browser restrictions), use this option which prompts users for their domain username/password:

<Directory "C:/path/to/your/php/scripts">
    AuthName "Windows Domain Login"
    AuthType Basic
    AuthBasicProvider winnt
    AuthUserFile /dev/null  # Required placeholder for mod_authnz_winnt
    Require valid-user
</Directory>

After editing the config, restart Apache to apply the changes.

Once Apache is handling authentication correctly, you can access the authenticated user's domain username directly via the $_SERVER superglobal. The value will be in the format DOMAIN\Username:

<?php
// Check if a user is authenticated
if (isset($_SERVER['REMOTE_USER'])) {
    $fullDomainUser = $_SERVER['REMOTE_USER'];
    echo "Current domain user: " . $fullDomainUser;

    // Optional: Split domain and username into separate variables
    list($domain, $username) = explode('\\', $fullDomainUser);
    echo "<br>Domain: " . $domain;
    echo "<br>Username: " . $username;
} else {
    echo "No authenticated domain user found.";
}
?>

• Empty $_SERVER['REMOTE_USER']:
  • Double-check that all required Apache modules are enabled and your config syntax is correct.
  • For seamless auth: Add your website to the browser's "Local Intranet" zone (IE/Edge) or configure Chrome to allow automatic credential passing (via group policy or command line flags).
  • Ensure the user is logged into the Windows domain on their local machine.
• Login prompt won't disappear:
  • Confirm with your domain admins that Kerberos is properly configured for the Apache server.
  • Make sure the server's hostname is registered correctly in DNS and matches its Kerberos Service Principal Name (SPN).

内容的提问来源于stack exchange，提问作者Roma