Re: web app security - user profile or validation list?

Yes the user name is in the confirmation file. Look at the example I sent. I think that kind of logging you're going to have to do yourself. Your alternative is to use "real" user profiles - which is fine as long as you limit their capabilities to web jobs only. We use a mix. Real users for maintenance and control tasks. Admin list users for individuals to control their own bookings etc.


Jon Paris

www.partner400.com
www.SystemiDeveloper.com

On Aug 21, 2018, at 4:01 PM, Steve Richter <stephenrichter@xxxxxxxxx> wrote:

but Jon, is that a single user in the apache .conf file? How would you
differentiate between validation list users? For example, when I DSPJRN,
I would like to see the name of the actual user who updated a file.


On Tue, Aug 21, 2018 at 3:49 PM, Jon Paris <jon.paris@xxxxxxxxxxxxxx> wrote:

Are you not seeing my posts Steve? We do not need to switch user. The
user that is defined in the apache profile I posted has the required
authorities (is actually part of a group for that purpose I think).

As to other comments re having the server job owning everything if you run
PHP that is just not my experience. And we run PHP apps all day every
day.


Jon Paris

www.partner400.com
www.SystemiDeveloper.com

On Aug 21, 2018, at 3:21 PM, Steve Richter <stephenrichter@xxxxxxxxx>

wrote:

On Tue, Aug 21, 2018 at 2:37 PM, Nathan Andelin <nandelin@xxxxxxxxx>

wrote

Later in the process, when you want PHP to "connect" to the database

server

(i.e. QZDASOINIT or QSQSRVR Job), you have to provide different

credentials

for that. It sounds like you want to authenticate using an IBM i user
profile for that, in order to take advantage of IBM i interfaces for
specifying data object authorities.

yes, but as I understand it, to switch from validation list user to an

IBM

i user profile user, you need the password of the IBM i user.

Would help if the validation list allowed a built in link to an

associated

user profile. What if the QSYGETPH accepted a validation list user name
and password as input arguments?
--
This is the Web Enabling the IBM i (AS/400 and iSeries) (WEB400) mailing

list

To post a message email: WEB400@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/web400
or email: WEB400-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/web400.

--
This is the Web Enabling the IBM i (AS/400 and iSeries) (WEB400) mailing
list
To post a message email: WEB400@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/web400
or email: WEB400-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/web400.

--
This is the Web Enabling the IBM i (AS/400 and iSeries) (WEB400) mailing list
To post a message email: WEB400@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/web400
or email: WEB400-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/web400.