1

I have a webpage hosted in my local server being displayed inside a Page Viewer Web Part in SharePoint 2007.

I would like to include a user check inside the pages in my server, so when an user tried to access some page through the SharePoint web part, the page would first check who is the user logged in SharePoint trying to access the page, and then check if the specific user is allowed to see that page.

I have tried the most common solutions found online using js and/or php: SPAPI, SPContext and Jquery SPServices, but wasn't able to make any of them work with the php pages in my local server.

Is there a practical way to get the user who is accessing the page? I am new to web development, so I would appreciate any help.

1
  • Are you using NTLM/BASIC or Forms-Based Authentication on this zone in your SharePoint Web Application?
    – Eccentropy
    Feb 6, 2014 at 18:03

1 Answer 1

1

If you want true security, and not something that is easily breakable, then you have two options that I see:

A) You need a custom webpart that iframes your PHP URL and uses an HMAC approach to add an authorization token to the iframe source URL as a query string parameter. The abstract mechanism would be:

  1. Your webpart code uses a shared key to encode a string in the format "johndoe|[timestamp]" (for purposes of this example, say that it encodes to ABCD12345678)
  2. Your webpart outputs an iframe tag with the url which has that encoded string as a parameter: http://myphpapp.mycompany.com/sppage.php?accesskey=ABCD12345678
  3. Your php code uses the shared key to decode the access key, ABCD12345678, back to "johndoe|[timestamp]"
  4. Your php code then verifies 'johndoe' has access to the page and also that [timestamp] is within an agreed upon time window. The timestamp part keeps someone from being able to copy the URL and distribute/reuse it

B) Your other option would be to enable PHP to do some sort of single-sign-on based on your authentication scheme. For example, if you use Active Directory, there are methods that will allow you to detect the active domain user. See https://stackoverflow.com/questions/168610/can-you-get-a-windows-ad-username-in-php for one discussion about this. If you do this correctly, the PHP should be able to detect the active user without any prompt for the user to provide credentials. Note that this option will probably be more difficult to get properly working across all browsers and devices.

2
  • Thanks @tyshock, I'll take a good look into the things you mentioned.. I believe the first step is to find out how to place a custom iframe in my sharepoint page, right?
    – brWHigino
    Feb 7, 2014 at 12:35
  • If you use that approach, you'll need a custom web part. If you are using a custom web part, echoing out some iframe tags will be pretty easy. If you're comfortable with Visual Studio, the entire process shouldn't be too difficult.
    – tyshock
    Feb 7, 2014 at 15:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.