Re: IBM i authentication and RESTful web service design

Kelly,

I feel a little badly about responding to this thread because I abandoned
the CGI interface about 15 years ago. I'm torn between recommending a
license to our web portal, or just dropping out of the discussion to let
others explain the nuances of CGI interfaces.

The program you use to authenticate users against your LDAP directory,
which is the entry-point into your "system", needs to place "something"
that represents each user's "authentication state" in a browser cookie, or
a query string parameter, or some kind of "session" object on your server,
which could be accessed by any CGI program which might be subsequently
called.

That begs the question - must every CGI program called subsequently check
the user's "authentication state" for each an every subsequent request?
I'll leave that to others to explain.