Re: Impersonating a user profile from PHP, Python or other web language

Kerberos for single-sign-on is available on i - it's called Network Authentication Service - and there is an identity-mapping facility called EIM or Enterprise Identity Mapping - this lets you have different user names in different context, and if you have an identity that is authenticated by some KDC - is that the term in Kerberos for key distribution center? If you have that identity that is now trusted, EIM lets map to an identity in YOUR context that has certain authorizations.

APIs exist for this on IBM i and are actually out there for Windows and AIX and maybe Linux.

If you want to know stuff from the guy who led the team that wrote a lot of this, go to http://www.botzandassociates.com/ - the "contact us" page has and email that is Pat Botz' or will get you to him. Go ahead and say I sent you - he had helped me a lot with a project enabling an application for SSO a few years ago. He does contract out for SSO installations but may give you some time and information.

HTH
Vern

On 10/17/2015 8:42 PM, Justin Dearing wrote:

Hello,

I'm contemplating writing a REST service for dealing with source members
that would work on any IBM i. Naturally, security is important here, and
I'd want things to run with a users user profile, not the user profile that
apache is running in.

So, each language has an ibm_db module with connect/pconnect calls that
will either take a trusted context as the user PHP runs as, or a user name
and password. The XML service seems to require a name and password.
Ideally, I want the users to transmit names and passwords once to get a
token, and then use that token for the rest of their session. Or even more
ideal would be something like kerberos where there were time sensitive
tickets.

Do I have this option on the IBM i? This is pretty important to me for this
project. I'd pick my language for this particular project solely on who has
the best security model for impersonating real user profiles.

BTW my ultimate goal once I wrote the REST API would be to morph it into a
WEBDAV implementation thats good enough for windows and MACs to mount and
most text editors to edit the files directly. Another solution, hardest for
me to write, and completely out of scope of web programming would be a
module for SAMBA to expose source members as a UNC mount. If any of these
things exist, please tell me so I don't waste my time. I have plenty of
windmills to tilt.

Justin