title: Can I force sqlsrv_connect (PHP) to use windows authentication with supplied credentials?
body: <p>Setup: intranet SQL Server and Domain Controller. In the DMZ we have a web server (IIS, PHP7).</p>
  
  <p>SQL Server has mixed mode authentication. I'm trying to migrate from an old API setup (PHP5, mssql_connect), to a new setup (PHP7, IIS).</p>
  
  <p>With the old API setup, authentication happens through mssql_connect using the supplied username and password, and connects to the sql server without a problem. The username and password are DOMAIN credentials, and setup on SQL SERVER as GROUPS. This makes it much easier to add/remove users, and works very well.</p>
  
  <p>New API setup attempt #1:
   - sqlsrv_connect: Supplying username and password forces sqlsrv_connect to use SQL USER authentication instead of WINDOWS authentication. Because the users are on the domain but NOT assigned directly to the SQL SERVER, this fails.</p>
  
  <p>attempt #2:
   - sqlsrv_connect: not supplying username and password forces sqlsrv_connect to connect via windows authentication with set credentials (not what we need). Yes, we could set these credentials to whatever we want, but then any stored procedures within SQL SERVER which check usernames might return our 'set user', rather than the actual client username.</p>
  
  <p>attempt #3:
   - PDO:sqlsrv: - Same thing with and without usernames.</p>
  
  <p>attempt #4:
   - do LDAP authentication (with credentials) then sqlsrv_connect (without credentials). This allows me to verify the user should have access to the database, but does not allow me to see the username from within stored procedures.</p>
  
  <p>I've read MANY posts on this topic from google, stackoverflow, and other places. NONE of them address having an API hosted in a DMZ where YOU DON'T WANT the WEBSERVER ITSELF to have credentials that can access the database. What we need is for the USER SUPPLIED credentials to be passed through the API (web server) and into the SQL server as "Windows Authentication" (not as SQL Users). That way any queries to the SQL server are performed as THE USER, and we can manage the users via the directory.</p>
  
  <p>Most of the posts infer that the users gave up and went with SQL USER authentication (sounds like a management headache), or enabled anonymous access from the webserver to SQL server (also seems like a bad idea with the webserver in the DMZ).</p>
  
  <p>Am I completely off my rocker to expect this to work? I know this is not a standard SO question, but I'm not sure where else to put this. If you know of any posts/pages where the above is done (using explicit credentials to connect with Windows Authentication with sqlsrv), please share.</p>
  
  <p>Thanks.</p>