title: Enable Intranet to check user access to shared files
body: <p>Windows Edition: Windows Server 2016 Standard<br>
  XAMPP Version 7.4.1<br>
  PHP Version 7.4.1<br>
  Using LDAP / TLS for user login</p>
  
  <p>Goal: I am building a local intranet to allow a company's employees to access shared files through the intranet web portal. I've already got the system links in place so that the user can open these shared files. Now, I'm trying to make sure regular users can't access the files which should be reserved for billing, human resources, etc.</p>
  
  <p>Problem: I can't directly compare a user's Security Group (from LDAP) to a PHP Permission Response (from <code>fileperms($path)</code>), to see if they match, before opening the folder.</p>
  
  <p>Through LDAP I can get a list of the user's Security Groups when they log in, which looks like this:</p>
  
  <p>User Security:</p>
  
  <ul>
  <li>Group A (regular access)</li>
  <li>Group B (billing access)</li>
  <li>Group C (accounting access)</li>
  <li>Etc.</li>
  </ul>
  
  <p>However, when I try to access a specific folder's permissions, I can only get the folder's permissions according to PHP's level of access, not the user's.</p>
  
  <p>For example: fileperms($path) = </p>
  
  <ul>
  <li>Owner: rwx</li>
  <li>Group: rwx</li>
  <li>World: rwx</li>
  </ul>
  
  <p>I could also extract this into octal form (such as "0777", etc), but I would still have the same problem. They don't "match".</p>
  
  <p>Now, this client's company is rather small, so I could just go and code a access profile for each user, which the intranet refers to when they try to access shared drives, but the next company is a lot bigger, so I'm looking for a way to automate this privilege-checking process.</p>
  
  <p>I've considered using the PHP POSIX extension to better interact with the files, but as I understand it, it won't work on a Windows system.</p>
  
  <p>I've consider launching a "run as" from the command line (through PHP's shell_ex($path), with the user's username and password, but I don't want to launch every file in the folder, just to see if the user has access!</p>
  
  <p>Is there a cmd line equivalent to PHP's "is_writable()", but taking into account the user's credentials? </p>
  
  <p>Something like:"is_writable newFolder 'username' 'password' "</p>
  
  <p>Which would give a boolean response, "true" if accessible and "false" if not?</p>