Re: web app security - user profile or validation list?

This is what part of our (slightly obfuscated) config file looks like. We run a mix of PHP and regular RPG CGIDEV2. You can see the User Id that is assigned and the setting of the associated library list.


<Directory /QSYS.LIB/SIDxxxxx.LIB/UPLOAD.PGM>
102 Order Allow,Deny
103 Allow From all
104 AuthType Basic
105 AuthName SiDSpeaker
106 PasswdFile SIDxxxxx/SPEAKERS
107 Require valid-user
108 UserID SIDxxx
109 SetEnv QIBM_CGI_LIBRARY_LIST "SIDxxxxx;QGPL;QTEMP"
110 </Directory>


Jon Paris

www.partner400.com
www.SystemiDeveloper.com

On Aug 21, 2018, at 12:37 PM, Steve Richter <stephenrichter@xxxxxxxxx> wrote:

not familiar with the userid parameter. ZENDPHP7 jobs run as QTMHHTTP.
When my PHP code calls db2_connect I pass empty string for the user name
and password.

$options = array('i5_naming' => DB2_I5_NAMING_ON);
if (strlen($libl) > 0)
{
$options['i5_libl'] = $libl ;
}
$conn = db2_connect("*LOCAL","","", $options);


mostly, I do not follow how if I use validation list, how best to switch to
an IBM i user profile.




On Tue, Aug 21, 2018 at 12:06 PM, Jon Paris <jon.paris@xxxxxxxxxxxxxx>
wrote:

Have you specified the UserId parameter in the server profile? Anyone
signing in using the validation list should be running under this User Id
and will have those access rights.

Does that not work for you?

--
This is the Web Enabling the IBM i (AS/400 and iSeries) (WEB400) mailing list
To post a message email: WEB400@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/web400
or email: WEB400-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/web400.