Difference between AUTH_USER and REMOTE_USER cgi variables

Question

The docs aren't entirely clear on this - is there a difference between these variables? On IIS at least they appear to be identical, but I don't want to rely on that if it might be different under other servers.

Augmentation

Answer 1

According to the Adobe ColdFusion documentation they are the same.

http://livedocs.adobe.com/coldfusion/8/htmldocs/help.html?content=Expressions_8.html

Looking at the openbd source code, the remote_user and the auth_user are mapped to the same key, so it returns the same value.

Looking at the railo source code, I'm not quite understanding what is going on, but it appears to be setting remote_user, and I'm not sure if auth_user is being set anywhere.

If you are designing an app that is compatible with coldfusion, railo, and openbd, it appears safer to use remote_user. Maybe someone else can comment because I don't fully understand the code without taking the time to investigate deeply.

Magdalenamagdalene

Adobe's docs seem to suggest remote_user is the preferred choice. – Magdalenamagdalene

Answer 2

REMOTE_USER and AUTH_USER will be the same in AdobeCF/IIS, but not on AdobeCF/Apache. AUTH_USER will be blank when using AdobeCF/Apache.

So it is best to code using the REMOTE_USER variable. If you find yourself working on code that references AUTH_USER in Apache, there is a way to make Apache populate that variable using mod_rewrite. This will cause Apache to copy REMOTE_USER into AUTH_USER:

RewriteEngine on RewriteCond %{REMOTE_USER} (.) RewriteRule . - [E=AUTH_USER:%1]

There is more info here: http://www.stillnetstudios.com/copying-env-variables-in-apache/

Piny

Answer 3

I'm fairly sure REMOTE_USER is the standard CGI variable.

According to this page, they are the same: http://livedocs.adobe.com/coldfusion/6/CFML_Reference/Expressions5.htm

Belter

Answer 4

to be on the safe side stick to REMOTE_USER as it is the one defined in the CGI/1.0 spec (Found here http://www.ietf.org/rfc/rfc3875)

AUTH_USER seems to have snuck in over time

Glasgow

Answer 5

In my experience, CGI variables tend to differ between Web Servers (Apache, IIS, JRun, etc), and even between their versions. The only safe bet, when basing something on a CGI variable, is to check what values show up on your dev, stage, production (etc) servers.

Rizal

From an apache point of view this variable isn't often available and I have need of it to be able to run an ldap SSO thingy ! Am I right in thinking that this variable comes from the laptop or device used to access the server url and NOT the server the url is hosted on. So for example running phpinfo(); on said laptop requesting this script on the server where is this variable supposed to come from ? Thank you for helping me understand more on this elusive subject. – Coffle