Re: PHP - authenticate and authorize using AS400 profile

I obviously need to become more familiar with the Zend architecture on i5.
I'm still wearing my traditional CGI hat.

Peter

-----Original Message-----
From: web400-bounces@xxxxxxxxxxxx [mailto:web400-bounces@xxxxxxxxxxxx] On Behalf Of Scott Klement
Sent: Monday, 9 November 2009 12:01 p.m.
To: Web Enabling the AS400 / iSeries
Subject: Re: [WEB400] PHP - authenticate and authorize using AS400 profile

UserID %%CLIENT%% doesn't work with Zend Core because the PHP is
actually running in a separate instance of Apache that runs in PASE. So
the UserID directive in the native Apache has no effect.

You could code the UserID directive in the PASE instance, but can't use
the value %%CLIENT%% because it's compiled for AIX and it doesn't
understand IBM i user profiles and passwords.

You *can* use PasswdFile %%SYSTEM%% on the proxy, and provided that the
PASE instance is only bound to localhost, that will force a valid
userid/password before the PHP script is invoked. But it won't run with
the user's authority, it'll still run as "NOBODY".

However, in the PHP script you could do this:

$conn = i5_connect( $_SERVER['HTTP_X_FORWARDED_SERVER'],
strtoupper($_SERVER['PHP_AUTH_USER']),
$_SERVER['PHP_AUTH_PW']);

At least then, any i5_xxx routines will run under the appropriate
user/password.

Peter Connell wrote:

Perhaps I am missing the point of this but if the task is to provide
a web page the can only be used by an AS400 profile then this is
commonly achieved by setting the Apache configuration to require that
such pages are protected by the AS400 system password file (
PasswdFile %%SYSTEM) and assigning Basic Authentication (AuthType
Basic). By also setting these requests to run as UserID %%CLIENT%%
then the HTTP server takes care of security automatically and any
server-side functions performed by the web page will already have
been authenticated by the HTTP server and can be trusted to execute
under profile designated by the server in the REMOTE_USER environment
variable which can be passed to any user defined routine.