[WEB400] Cross platform/AS400 security authentication & Folder security

["Wills, Mike N. (TC)" <MNWills@xxxxxxxxxxxxxx>]

We are in progress of building getting a web based report distribution
system going via our intranet which we would like to handle all of the
security. We are currently looking at where we are going to store these
reports for this program to pick up. This program can be passed any URL for
displaying folders or individual files. We want to try to avoid using the
400 because of the price of disk space.

Has anyone done cross platform authentication? For example, we store our
reports on an NT server. The user logs in to the program on the 400 clicks
on a link and the report pops up. Right now we are trying to figure out the
easiest way, both in the long run and for development (if any). The current
problems we can see are we can't leave the NT web server wide open because
that will defeat the purpose of security and we would hate for the user have
to do two logins.

Also, we want to be able to display all of the reports in a particular
folder, but we don't want the user to be able to browse around beyond the
page we display. The problem with the standard directory display is that it
has a link to the parent directory. I have a really basic servlet that
eliminates that problem, but then, that creates a new problem. If you have a
smart or curious user they will be able to start playing with the parameters
that get passed and display stuff they don't have access to. This problem
will exist for any platform.


Mike Wills