Re: PHP - authenticate and authorize using AS400 profile

[Aaron Bartell <aaronbartell@xxxxxxxxx>]

I know where you are coming from Peter, but if this is a
non-technical-person login then I would for sure stray away from the HTTP
Basic Auth approach because the login is so different than normal logins.
For example, it doesn't really tell you that you entered in a wrong
user/password, it just redisplays the same popup login.  And if you hit
cancel it takes you to a "you are not authorized..." type message that is
generated by the application server (i.e. Apache).

Aaron Bartell
http://mowyourlawn.com
http://mowyourlawn.com/blog/


On Sun, Nov 8, 2009 at 1:11 PM, Peter Connell <
Peter.Connell@xxxxxxxxxxxxxxxxx> wrote:

> Perhaps I am missing the point of this but if the task is to provide a web
> page the can only be used by an AS400 profile then this is commonly achieved
> by setting the Apache configuration to require that such pages are protected
> by the AS400 system password file ( PasswdFile %%SYSTEM) and assigning Basic
> Authentication (AuthType Basic). By also setting these requests to run as
> UserID %%CLIENT%% then the HTTP server takes care of security automatically
> and any server-side functions performed by the web page will already have
> been authenticated by the HTTP server and can be trusted to execute under
> profile designated by the server in the REMOTE_USER environment variable
> which can be passed to any user defined routine.
>
> Peter
>
> -----Original Message-----
> From: web400-bounces@xxxxxxxxxxxx [mailto:web400-bounces@xxxxxxxxxxxx] On
> Behalf Of Kelly Cookson
> Sent: Monday, 9 November 2009 12:33 a.m.
> To: Web Enabling the AS400 / iSeries
> Subject: [WEB400] PHP - authenticate and authorize using AS400 profile
>
> I've been working on a PHP function that: (1) authenticates a user by
> connecting to the AS400, and (2) authorizes a user based on information
> from the user profile.  I've included the code at the end of this post.
>
>
>
> The code works. My question has to do with accepting the user name and
> password from the $_POST array.
>
>
>
> I know the mantra is "never trust user input."  However, we use long
> passwords, and we encourage users to make up passwords that include
> special characters. Do I need to scrub the input at all, since I'm only
> using it to establish a connection and set a $_SESSION variable? Should
> I scrub certain characters (and tell users they can't include those
> characters in their passwords)? If so, which characters?
>
>
>
> Thanks,
>
> Kelly
>
>
>
> Note: the script below assumes users are authorized to access an
> application if they belong to the *SECOFR user class or they belong a
> supplemental group called MYGROUP.
>
>
>
> function validateUser()
>
> {
>
>    //Step 1: Authenticate the user by connecting to the AS400.
>
>    $username=$_POST["user"];
>
>    $password=$_POST["password"];
>
>    $conn = i5_connect("myas400",$username,$password);
>
>    if (!$conn)
>
>    {
>
>        $result = "Invalid username or password.";
>
>    }
>
>    else
>
>    {
>
>        //Step 2. Authorize the user by checking profile information;
>
>        $rtvusrprf = (i5_command("rtvusrprf",
>
>            array("usrprf"=>"*CURRENT"),
>
>            array("usrcls"=>"usrcls","supgrpprf"=>"supgrpprf"),
>
>            $conn));
>
>        if (!$rtvusrprf)
>
>        {
>
>            $result = "Authorization error.";
>
>        }
>
>        else
>
>        {
>
>            if ($usrcls == "*SECOFR")
>
>            {
>
>                $_SESSION["user"] = $username;
>
>                $result = "Thank you for signing in.";
>
>            }
>
>            else
>
>            {
>
>                $supgrps = str_split($supgrpprf, 10);
>
>                if (in_array("MYGROUP", $supgrps))
>
>                {
>
>                    $_SESSION["user"] = $username;
>
>                    $result = "Thank you for signing in.";
>
>                }
>
>                else
>
>                {
>
>                    $result = "Not authorized for this application.";
>
>                }
>
>            }
>
>        }
>
>        //Step 3. Close connection. Use the NOBODY profile for better
> performance.
>
>        i5_close($conn);
>
>    }
>
>    return $result;
>
> }
>
>
>
>
>
> --
> This is the Web Enabling the AS400 / iSeries (WEB400) mailing list
> To post a message email: WEB400@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/web400
> or email: WEB400-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/web400.
>
> Visit our website www.vedaadvantage.com. It has a new design with improved
> navigation and search capabilities; and customer friendly interface with
> more relevant insights and solutions to help you make informed decisions.
>
>
> #####################################################################################
>
> This correspondence is for the named person's use only. It may contain
> confidential
> or legally privileged information, or both. No confidentiality or privilege
> is waived
> or lost by any mistransmission. If you receive this correspondence in
> error, please
> immediately delete it from your system and notify the sender. You must not
> disclose,
> copy or rely on any part of this correspondence if you are not the intended
> recipient.
> Any views expressed in this message are those of the individual sender,
> except where
> the sender expressly, and with authority, states them to be the views of
> Veda Advantage.
> If you need assistance, please contact Veda Advantage on either :-
> Australia 1300-921-621 or New Zealand +64 9 367 6200
> --
> This is the Web Enabling the AS400 / iSeries (WEB400) mailing list
> To post a message email: WEB400@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/web400
> or email: WEB400-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/web400.