|
Perhaps I am missing the point of this but if the task is to provide a web
page the can only be used by an AS400 profile then this is commonly achieved
by setting the Apache configuration to require that such pages are protected
by the AS400 system password file ( PasswdFile %%SYSTEM) and assigning Basic
Authentication (AuthType Basic). By also setting these requests to run as
UserID %%CLIENT%% then the HTTP server takes care of security automatically
and any server-side functions performed by the web page will already have
been authenticated by the HTTP server and can be trusted to execute under
profile designated by the server in the REMOTE_USER environment variable
which can be passed to any user defined routine.
Peter
-----Original Message-----
From: web400-bounces@xxxxxxxxxxxx [mailto:web400-bounces@xxxxxxxxxxxx] On
Behalf Of Kelly Cookson
Sent: Monday, 9 November 2009 12:33 a.m.
To: Web Enabling the AS400 / iSeries
Subject: [WEB400] PHP - authenticate and authorize using AS400 profile
I've been working on a PHP function that: (1) authenticates a user by
connecting to the AS400, and (2) authorizes a user based on information
from the user profile. I've included the code at the end of this post.
The code works. My question has to do with accepting the user name and
password from the $_POST array.
I know the mantra is "never trust user input." However, we use long
passwords, and we encourage users to make up passwords that include
special characters. Do I need to scrub the input at all, since I'm only
using it to establish a connection and set a $_SESSION variable? Should
I scrub certain characters (and tell users they can't include those
characters in their passwords)? If so, which characters?
Thanks,
Kelly
Note: the script below assumes users are authorized to access an
application if they belong to the *SECOFR user class or they belong a
supplemental group called MYGROUP.
function validateUser()
{
//Step 1: Authenticate the user by connecting to the AS400.
$username=$_POST["user"];
$password=$_POST["password"];
$conn = i5_connect("myas400",$username,$password);
if (!$conn)
{
$result = "Invalid username or password.";
}
else
{
//Step 2. Authorize the user by checking profile information;
$rtvusrprf = (i5_command("rtvusrprf",
array("usrprf"=>"*CURRENT"),
array("usrcls"=>"usrcls","supgrpprf"=>"supgrpprf"),
$conn));
if (!$rtvusrprf)
{
$result = "Authorization error.";
}
else
{
if ($usrcls == "*SECOFR")
{
$_SESSION["user"] = $username;
$result = "Thank you for signing in.";
}
else
{
$supgrps = str_split($supgrpprf, 10);
if (in_array("MYGROUP", $supgrps))
{
$_SESSION["user"] = $username;
$result = "Thank you for signing in.";
}
else
{
$result = "Not authorized for this application.";
}
}
}
//Step 3. Close connection. Use the NOBODY profile for better
performance.
i5_close($conn);
}
return $result;
}
--
This is the Web Enabling the AS400 / iSeries (WEB400) mailing list
To post a message email: WEB400@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/web400
or email: WEB400-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/web400.
Visit our website www.vedaadvantage.com. It has a new design with improved
navigation and search capabilities; and customer friendly interface with
more relevant insights and solutions to help you make informed decisions.
#####################################################################################
This correspondence is for the named person's use only. It may contain
confidential
or legally privileged information, or both. No confidentiality or privilege
is waived
or lost by any mistransmission. If you receive this correspondence in
error, please
immediately delete it from your system and notify the sender. You must not
disclose,
copy or rely on any part of this correspondence if you are not the intended
recipient.
Any views expressed in this message are those of the individual sender,
except where
the sender expressly, and with authority, states them to be the views of
Veda Advantage.
If you need assistance, please contact Veda Advantage on either :-
Australia 1300-921-621 or New Zealand +64 9 367 6200
--
This is the Web Enabling the AS400 / iSeries (WEB400) mailing list
To post a message email: WEB400@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/web400
or email: WEB400-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/web400.
As an Amazon Associate we earn from qualifying purchases.
This mailing list archive is Copyright 1997-2024 by midrange.com and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available on our policy page. If you have questions about this, please contact [javascript protected email address].
Operating expenses for this site are earned using the Amazon Associate program and Google Adsense.
midrange.com
