Re: PHP - authenticate and authorize using AS400 profile

[Nathan Andelin <nandelin@xxxxxxxxx>]

Hi Kelly,

<vendor response>

You might consider using OnePoint Portal to handle user authentication, authorization, navigation, and access to PHP applications.  Contact me privately, if interested.  OnePoint offers three (3) choices for authentication:

1. OnePoint User Profile
2. IBM i User Profile
3. User Defined (such as LDAP)

We use QSYGETPH when authenticating against IBM i user profiles, which may trigger the following errors:

CPF2203 E User profile &1 not correct. 
CPF2204 E User profile &1 not found. 
CPF2213 E Not able to allocate user profile &1. 
CPF2225 E Not able to allocate internal system object. 
CPF22E2 E Password not correct for user profile &1. 
CPF22E3 E User profile &1 is disabled. 
CPF22E4 E Password for user profile &1 has expired. 
CPF22E5 E No password associated with user profile &1. 
CPF22E6 E Maximum number of profile handles have been generated. 
CPF22E9 E *USE authority to user profile &1 required. 
CPF24B4 E Severe error while addressing parameter list. 
CPF3BC7 E CCSID &1 outside of valid range. 
CPF3BDE E CCSID &1 not supported by API. 
CPF3C1D E Length specified in parameter &1 not valid. 
CPF3C3C E Value for parameter &1 not valid. 
CPF3C36 E Number of parameters, &1, entered for this API was not valid. 
CPF3C90 E Literal value cannot be changed. 
CPF3CF1 E Error code parameter not valid. 
CPF4AB8 E Insufficient authority for user profile &1. 
CPF9872 E Program or service program &1 in library &2 ended. Reason code &3.

 
In the event of an expired password, the user is able to key a new one, which is again validated against all IBM i password rules.

If you're going to be doing much web application development for different types of users, you'll need something more robust for managing user authority and access, too.

</vendor response>

-Nathan



----- Original Message ----
From: Kelly Cookson <KCookson@xxxxxxxxxxxx>
To: Web Enabling the AS400 / iSeries <web400@xxxxxxxxxxxx>
Sent: Sun, November 8, 2009 4:33:13 AM
Subject: [WEB400] PHP - authenticate and authorize using AS400 profile

I've been working on a PHP function that: (1) authenticates a user by
connecting to the AS400, and (2) authorizes a user based on information
from the user profile.  I've included the code at the end of this post.



The code works. My question has to do with accepting the user name and
password from the $_POST array. 



I know the mantra is "never trust user input."  However, we use long
passwords, and we encourage users to make up passwords that include
special characters. Do I need to scrub the input at all, since I'm only
using it to establish a connection and set a $_SESSION variable? Should
I scrub certain characters (and tell users they can't include those
characters in their passwords)? If so, which characters? 



Thanks,

Kelly



Note: the script below assumes users are authorized to access an
application if they belong to the *SECOFR user class or they belong a
supplemental group called MYGROUP. 



function validateUser()

{

    //Step 1: Authenticate the user by connecting to the AS400.

    $username=$_POST["user"];

    $password=$_POST["password"];

    $conn = i5_connect("myas400",$username,$password);

    if (!$conn)    

    {

        $result = "Invalid username or password.";

    }

    else

    {

        //Step 2. Authorize the user by checking profile information;

        $rtvusrprf = (i5_command("rtvusrprf",

            array("usrprf"=>"*CURRENT"),

            array("usrcls"=>"usrcls","supgrpprf"=>"supgrpprf"), 

            $conn));

        if (!$rtvusrprf)

        {

            $result = "Authorization error.";

        }

        else

        {

            if ($usrcls == "*SECOFR")

            {

                $_SESSION["user"] = $username;

                $result = "Thank you for signing in.";

            }

            else

            {

                $supgrps = str_split($supgrpprf, 10);

                if (in_array("MYGROUP", $supgrps))

                {

                    $_SESSION["user"] = $username;

                    $result = "Thank you for signing in.";

                }

                else

                {

                    $result = "Not authorized for this application.";

                }

            }

        } 

        //Step 3. Close connection. Use the NOBODY profile for better
performance.

        i5_close($conn);

    }

    return $result;

}