How to grab png binary stream when CAC authentication is required?

[mrudd81]

Normally, when viewing the USAF weather data web site in the browser, smart card/PKI authentication is required (prompts user for pin). The site uses a data service that uses url parameters to request specific data. Requesting text-based data is returned within XML, image-based data is returned as binary data.

This app needs to automate saving image data (png) to files. I see two basic ways of doing this -- grab the data directly from the query (using file_get_contents or some other method -- file_get_contents hasn't worked for me yet), or load the images on the page and grab them from the img src attributes and save them. This is where I'm stuck, as PHP would talk server-to-server and not sure how I would cause them to prompt for authentication before processing the request, and JavaScript might be able to grab image data from within the browser, but it can't save the data to file on the web server.

I have an idea to try to paint the image data on an HTML 5 canvas object and grab it from there, but I haven't played with it yet.

[mrudd81]

Ok here's an update:

Tried using the HTML5 canvas, but it appears that even doing that still requires a type of access to the originating server that's blocked. I've run the JavaScript for it in Chrome and IE and both kick back unauthorized access or security errors.

I found a previously-working VBA solution, but it's a year old and it seems that the server won't even allow that workaround anymore. Going to try one more option ... there's an Excel-based weather outlook generator (a.k.a. Geyerware) that depends on access to the server, so maybe I can find a way through that.

[JacobCallahan]

some links that might help

http://www.slideshare.net/rbulling/enabling-web-apps-for-dod-security-via-pkicac-enablement-forgemil-case-study

http://stackoverflow.com/questions/834805/apache-authentication-via-dod-pki-cac

http://www.php-security.net/archives/3-X.509-PKI-login-with-PHP-and-Apache.html

[mrudd81]

Unfortunately these seem to deal with authenticating via PKI within the app itself, not authenticating with the other server. I'll keep looking though, thanks!

[JacobCallahan]

yep, but once you store the authentication, you may be able to pass that along to the server. maybe....

[mrudd81]

Finally found a workaround using VBA. Apparently wasn't using quite the right combo of HTTP functions, but got that finessed. While the new process does work, I found a strange quirk in which the VBA won't/can't download images from a given query URL unless that URL has been loaded in a browser already at least once. Easy fix for that is to automate a script that builds an HTML page to open that loads all required products, then the user can run the VBA to download the images. It's an odd step to need to do, but not terribly cumbersome.

[JacobCallahan]

@hyperioware good job!