.htaccess problem with people with identical usernames

.htaccess problem with people with identical usernames - .htaccess files are extremely useful in many cases for users who either do not have root permissions or for users who simply aren't comfortable in making changes in their web server's configuration file. Trying to debug .htaccess not working isn't always the easiest thing to do, however, hopefully by checking the discuss below mentioned about htaccess, password, htpasswd, , .htaccess common problems as well as the troubleshooting tips, you'll have a better grasp on what you may have to modify to get your .htaccess file running smoothly.Problem :

I've recently set up a password protected area on a client's website, but there's an issue where several of the members of the organisation concerned have identical usernames, although, obviously, different passwords.

For example, if there are two people with the username of John Smith, only the first John Smith listed in the .htpasswd file can gain access. However, if I change their order in that file, then only the other John Smith can gain access.

It seems that once having found what it thinks is an incorrect username/password combination, .htaccess doesn't look any further to see if there are any other people named John Smith and if their passwords are correct.

Is there an easy solution to this problem?

The obvious one is to ensure that usernames are unique, however in this situation I'm constrained to using the members' real names as contained in an existing membership database, as their username.

Solution :

I might tackle this problem by not using .htaccess and instead replace it with php code (looks better, allows more granular control and tracking of the different users. Authentication could be done using a select on both username and hashed password, although the same username weakens the hashing a bit for those users.

If you do need to use webserver based authentication, backend it with an authentication mechanism you can control. I didnt find a MySQL one that would work (although I did not look that hard) but http://mod-auth-pq-sql.sourceforge.net is a postgres module which allows you to craft an sql statement that you could code to your requirement.

Additionally, if you would like to do some further testing, give the htaccess tester tool a try. It allows you to specify a certain URL as well as the rules you would like to include and then shows which rules were tested, which ones met the criteria, and which ones were executed.