Re: validation list usage scenario

It seems as if you are making this WAY more complicated than it need be Steve.

We don't (and wouldn't) use a regular user profile in a validation list. Validation list users do not use the system in the normal sense. It is just a way of grouping together web users who have no need for a conventional sign on with all the associated security considerations. For a given group of web users we assign a specific user profile (identified in the apache config) to the group. That controls what they can do. Apache takes care of the switch.

When the user signs in we store the user Id in the session. No need to store the password - we don't need it. If we need to log any of the actions as specific to a user we use the stored user Id.

That's it. All security is via the user Id associated with the validation list group.

What more do you need?


Jon Paris

www.partner400.com
www.SystemiDeveloper.com

On Aug 22, 2018, at 11:03 AM, Steve Richter <stephenrichter@xxxxxxxxx> wrote:

is it secure to have a user profile name associated with a validation list
entry name, and then have the user enter the same password in the
validation list as they do for their IBM i user profile.

The PHP code of a web site could store the validation list user and
password in $_SESSION variables. Then as part of validating to the
validation list, check if the validation list user name has an IBM i user
profile associated with it.

If it does, call QSYGETPH with that user profile name and the validation
list password. If the password is accepted, call QWTSETP to switch to run
the PHP code as that user profile.

assuming you are running HTTPS, what are security problems with doing this?

thanks,
--
This is the Web Enabling the IBM i (AS/400 and iSeries) (WEB400) mailing list
To post a message email: WEB400@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/web400
or email: WEB400-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/web400.