Home  >  Q&A  >  body text

Implementing access to files on a Windows domain shared drive in PHP

<p>I have a bunch of documents stored on a standalone machine that I need to serve from a PHP/IIS server. The problem is that the document drive is connected to an Active Directory domain machine and the web server is not connected, so I'm not sure where to provide the authenticated AD user that PHP needs to access the drive. </p> <p>I have an IIS application pool calling PHP, running as a new Windows user that I created (set to "Identity" for the application pool, and the Anonymous Authentication user for the website). I logged into the server as this new user and set up a mapped network drive, but after some research I thought this was a dead end; I read that the service would not log into Windows in such a way as to mount the mapped drive. </p> <p>Referencing only by IP address is closer to working, but I'm getting authentication errors. The main solution I've found online is to run the application pool as a user with access to the drive, but I don't know if that's possible since the server isn't in that Windows domain. (But I’m not an AD expert either)</p> <pre class="brush:php;toolbar:false;">echo shell_exec('whoami'); //Output the name of the Windows user I created echo scandir('\\\\192.168.1.120\\data$'); //Cannot find username/password echo trim(shell_exec('dir \\\\192.168.1.120\\data$ 2>&1')); //The username or password is incorrect echo scandir('Z:\\'); // PHP warning that path cannot be found echo trim(shell_exec('dir Z: 2>&1')); //path not found</pre> <p>If there isn't a simple, non-hack solution, I could see if the customer could put the web server in the AD domain, but I don't know if that would have unintended side effects on other services the server is running. </p>
P粉323224129P粉323224129388 days ago418

reply all(1)I'll reply

  • P粉765570115

    P粉7655701152023-08-31 18:06:03

    If these are public and do not require users to authenticate to the directory, do not put them in the domain. However, if you need some kind of authentication or looking up information from AD, you might consider running Active Directory Application Mode (ADAM) in the DMZ. You may need to copy the relevant information from AD to the application partition, as ADAM does not synchronize standard AD partitions.

    Of course, if the web server is on the same network as the domain controller, it can be added to the domain to increase manageability.

    reply
    0
  • Cancelreply