Re: Hiding web service sign-on information

Hi James

It sounds like you need to strictly manage who sees this source. At some point you need to trust your people.

Having said that, encryption comes to mind. You'd have similar challenges, perhaps, with visibility. But if a decrypting program is set *OWNER and you manage, again, who can use the owner's profile, it should be possible to manage this.

Just a couple thoughts - others will lend better ideas, I'm sure.

HTH
Vern

On 9/3/2020 10:37 AM, James H. H. Lampert wrote:

Ladies and Gentlemen of the Midrange and HTTPAPI/FTPAPI Lists:

We have a situation in which we have AS/400 programs (created and running on customer boxes), called from batch jobs, that access web services (which we host), which require a sign-on. Access is via HTTPAPI.

The problem is protecting the web service sign-on information from the prying eyes of potentially malicious users.

If we call a "factory" program or module that vends the information, what's to stop anybody who can see the call in the source from writing their own program to call the factory?

If we provide a "wrapper" that passes the information to the programs that call the web services, what's to stop anybody who sees how the programs get the information from the wrapper from plugging their own programs into the wrapper?

Anybody know of any good ideas in this regard?

--
JHHL