813082 - Support for Windows Authentication using IIS

Status: UNCONFIRMED

(Bugzilla :: Administration, task)

Description

[Torsten Martinsen]

Attachment: Patch against 4.2.4

When using Windows Authentication in IIS (at least with version 7), IIS sets REMOTE_USER to DOMAIN\login. This breaks Bugzilla (when auth_env_email is set to REMOTE_USER).

The attached simple patch fixes this issue for me.

Comment 1

[Frédéric Buclin]

This is a duplicate of bug 125121, isn't it? Or at least it blocks that bug.

Comment 2

[Frédéric Buclin]

Note that Microsoft doesn't recommend to use Windows Authentication:

"Windows authentication is not appropriate for use in an Internet environment, because that environment does not require or encrypt user credentials."

Anyway, as \ is not legal in email addresses, your patch shouldn't mess with email addresses. But I wonder if it could mess with some other authentication method.

Comment 3

[Torsten Martinsen]

(In reply to Frédéric Buclin from comment #2)
> Note that Microsoft doesn't recommend to use Windows Authentication:
> 
> "Windows authentication is not appropriate for use in an Internet
> environment, because that environment does not require or encrypt user
> credentials."

Correct. The server in question is not accessible to the Internet.

Comment 4

[Torsten Martinsen]

(In reply to Frédéric Buclin from comment #1)
> This is a duplicate of bug 125121, isn't it? Or at least it blocks that bug.

I don't believe it is. Authentication works fine on Windows using Apache.