Re: Impersonating a user profile from PHP, Python or other web language

[Vernon Hamberg <vhamberg@xxxxxxxxxxxxxxx>]

Kerberos for single-sign-on is available on i - it's called Network 
Authentication Service - and there is an identity-mapping facility 
called EIM or Enterprise Identity Mapping - this lets you have different 
user names in different context, and if you have an identity that is 
authenticated by some KDC - is that the term in Kerberos for key 
distribution center? If you have that identity that is now trusted, EIM 
lets map to an identity in YOUR context that has certain authorizations.

APIs exist for this on IBM i and are actually out there for Windows and 
AIX and maybe Linux.

If you want to know stuff from the guy who led the team that wrote a lot 
of this, go to http://www.botzandassociates.com/ - the "contact us" page 
has and email that is Pat Botz' or will get you to him. Go ahead and say 
I sent you - he had helped me a lot with a project enabling an 
application for SSO a few years ago. He does contract out for SSO 
installations but may give you some time and information.

HTH
Vern

On 10/17/2015 8:42 PM, Justin Dearing wrote:
> Hello,
>
> I'm contemplating writing a REST service for dealing with source members
> that would work on any IBM i. Naturally, security is important here, and
> I'd want things to run with a users user profile, not the user profile that
> apache is running in.
>
> So, each language has an ibm_db module with connect/pconnect calls that
> will either take a trusted context as the user PHP runs as, or a user name
> and password. The XML service seems to require a name and password.
> Ideally, I want the users to transmit names and passwords once to get a
> token, and then use that token for the rest of their session. Or even more
> ideal would be something like kerberos where there were time sensitive
> tickets.
>
> Do I have this option on the IBM i? This is pretty important to me for this
> project. I'd pick my language for this particular project solely on who has
> the best security model for impersonating real user profiles.
>
> BTW my ultimate goal once I wrote the REST API would be to morph it into a
> WEBDAV implementation thats good enough for windows and MACs to mount and
> most text editors to edit the files directly. Another solution, hardest for
> me to write, and completely out of scope of web programming would be a
> module for SAMBA to expose source members as a UNC mount. If any of these
> things exist, please tell me so I don't waste my time. I have plenty of
> windmills to tilt.
>
> Justin