Re: Web site authentication

["Bill Meecham" <meechamw@xxxxxxx>]

authentication is built into our webSOA product from Advanced Business Link.
  ----- Original Message ----- 
  From: Michael Daly 
  To: Web Enabling the AS400 / iSeries 
  Sent: Monday, August 27, 2007 10:05 PM
  Subject: Re: [WEB400] Web site authentication


  Validation lists

  Mike Cunningham <mcunning@xxxxxxx> wrote: I am interested in a quick poll on how other iSeries shops who are developing web applications are doing authentication. Are you using the built in Apache mod?  If so are you authenticating using iSeries userids, LDAP or Auth Lists? If not using the Apache mod did you write your own with the same questions on what directory you authenticate against.  Are you using persistent sessions or browser session cookies to maintain who is doing what?

  To answer for myself, we wrote our own authentication process using the IBM APIs to validate userid/password against iSeries userids but are going to extend that to also authenticate over LDAP to our Active Directory tree. We are not using persistent sessions and use session cookies. The cookie has nothing but a 64 byte string that we create on logon and keep in the database. Every hit is checked to see if the cookie exists, has not timed out and who it is associated with.