I'm still not convinced you're approaching this the right way, but I don't think the QSYGETPH requires a password if the requester has *USE rights to the profile who's handle is being retrieved, from the manual:
"
PASSWORD
*NOPWD The user requesting the profile handle must have *USE authority to the user profile.
A profile handle does not get created for a disabled user profile.
A profile handle does not get created for a user profile with an expired password.
"
You could wrap the switching functionality up in a program with USER(*OWNER) and have the owning profile have *USE rights to the user's user profiles and then restrict access to this program to just the profile under which the PHP job will run in order to stop it being abused. I don't think it's particularly safe, but it might work.
________________________________
From: WEB400 <web400-bounces@xxxxxxxxxxxx> on behalf of Steve Richter <stephenrichter@xxxxxxxxx>
Sent: 22 August 2018 17:03
To: Web Enabling the AS400 / iSeries
Subject: [WEB400] validation list usage scenario
is it secure to have a user profile name associated with a validation list
entry name, and then have the user enter the same password in the
validation list as they do for their IBM i user profile.
The PHP code of a web site could store the validation list user and
password in $_SESSION variables. Then as part of validating to the
validation list, check if the validation list user name has an IBM i user
profile associated with it.
If it does, call QSYGETPH with that user profile name and the validation
list password. If the password is accepted, call QWTSETP to switch to run
the PHP code as that user profile.
assuming you are running HTTPS, what are security problems with doing this?
thanks,
--
This is the Web Enabling the IBM i (AS/400 and iSeries) (WEB400) mailing list
To post a message email: WEB400@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit:
https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.midrange.com%2Fmailman%2Flistinfo%2Fweb400&data=02%7C01%7C%7Cf789e3fdd25448c2a2a908d608407347%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636705470230845793&sdata=I1zE0n8PYevBdK%2Bkv5IGysbt3ILvQVL0YwPXr7cQQBk%3D&reserved=0
or email: WEB400-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at
https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Farchive.midrange.com%2Fweb400&data=02%7C01%7C%7Cf789e3fdd25448c2a2a908d608407347%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636705470230845793&sdata=RHQjy5r4jTVI9%2Fu6tnbJW%2B9%2FFgcwic9f9yaWKK7572I%3D&reserved=0.
midrange.com
