Programmatically access windows share in php via kerberos or ntlm

Question

I have a few requirements here on which I am not sure if they're even possible the way they're requested. Sorry beforehand for not having code, but I feel stackoverflow fits the most for this question, and I can't write code on company time before the situation is clear.

Setup
A windows server with an IIS and PHP running via FCGI. There's an intranet (php/mysql) running on this machine. Users currently have anonymous access to it, since it is an open intranet. All users are in the same windows domain.

SSO and windows shares
As far as my research got, single sign on via NTLM is possible and should not be a biggie to implement into the current intranet. However, there's a plugin running which reads directories from defined windows shares, and spits out a file list. Those files are read by a specific user account having read access to this share.

Is it possible to authenticate the current user at the windows share to read files, via that data I receive from SSO (via ntlm or kerberos or ...)?

Answer 1

You need Kerberos, Credential Deleagtion and Impersonation. Forget NTLM.

Edit: On Windows, this is solved by SSPI, on Unix by GSS-API.