ADO.NET provider and iSeries security

Looking for ideas from the list experts ...

We have an ASP.NET query application using ADO.NET to access a MS SQL
Server database within a Windows web application we developed.
We wrote the query application to work with different data providers so we
could also use the iSeries Access .NET Data Provider and
query our iSeries databases.

I would like to validate the iSeries user/password information by having
the users log in through Apache on the iSeries and
then "launch" the .NET application and pass it valid user credential that
it could use to access the iSeries databases
that the user is authorized to.   I would like to avoid passing the iSeries
user id and password in the query string.

I thought that getting a profile handle might a good route, but the API
indicates that the handle can only be used in
the job that created it so that doesn't appear to be a workable option.  My
original idea was going to be that the .NET
provider would establish its connection with a "generic" iSeries user and
then switch to the query user using the handle.

I also have started reviewing profile token APIs but I'm not sure if they
would help yet.

Any thoughts would be appreciated.
----------------------

Scott A. Schollenberger
Director, R&D
TENEX Systems and ACE Software, divisions of Harris Computer Systems

E-mail: saschollenberger@xxxxxxxxxxxx