Re: Web site authentication

Mike

Have you ever considered just connecting to the iSeries Database, and then
deciding which authentication method you should use...?

Regards

Maurice O'Prey






-----Original Message-----
From: web400-bounces@xxxxxxxxxxxx [mailto:web400-bounces@xxxxxxxxxxxx] On
Behalf Of Mike Cunningham
Sent: 27 August 2007 13:18
To: Web Enabling the AS400 / iSeries
Subject: [WEB400] Web site authentication

I am interested in a quick poll on how other iSeries shops who are
developing web applications are doing authentication. Are you using the
built in Apache mod? If so are you authenticating using iSeries userids,
LDAP or Auth Lists? If not using the Apache mod did you write your own with
the same questions on what directory you authenticate against. Are you
using persistent sessions or browser session cookies to maintain who is
doing what?

To answer for myself, we wrote our own authentication process using the IBM
APIs to validate userid/password against iSeries userids but are going to
extend that to also authenticate over LDAP to our Active Directory tree. We
are not using persistent sessions and use session cookies. The cookie has
nothing but a 64 byte string that we create on logon and keep in the
database. Every hit is checked to see if the cookie exists, has not timed
out and who it is associated with.