title: Should i trust php variable $_SERVER[AUTH_USER] when signing in via Windows Authentication? IIS intranet hosted app
body: <p>I've hosted (on IIS 7.5) basic php website, which simply returns me $<em>SERVER variable contents. I have notcied that there are AUTH</em>* array fields:</p>
  
  <pre><code>["AUTH_USER"]=&gt;
  string(18) "MYDOMAIN\my_username"
  ["AUTH_PASSWORD"]=&gt;
  string(0) ""
  ["AUTH_TYPE"]=&gt;
  string(9) "Negotiate"
  // .... some more variables
   ["HTTP_AUTHORIZATION"]=&gt;
  string(174) "Negotiate (token_here)"
  </code></pre>
  
  <p>Why AUTH_PASSWORD is empty?
  Also, should i trust this variable? Can i safely assume that user "my_username" has successfully been logged ?
  Also should i do anything with "HTTP_AUTHORIZATION" token ? Should i verify it?</p>
  
  <p>I'll appreciate any help.</p>
  
  <p>EDIT:
  Someone asked about code, there is no code, only this:</p>
  
  <pre><code>var_dump($_SERVER);
  </code></pre>