Re: PHP - authenticate and authorize using AS400 profile

UserID %%CLIENT%% doesn't work with Zend Core because the PHP is actually running in a separate instance of Apache that runs in PASE. So the UserID directive in the native Apache has no effect.

You could code the UserID directive in the PASE instance, but can't use the value %%CLIENT%% because it's compiled for AIX and it doesn't understand IBM i user profiles and passwords.

You *can* use PasswdFile %%SYSTEM%% on the proxy, and provided that the PASE instance is only bound to localhost, that will force a valid userid/password before the PHP script is invoked. But it won't run with the user's authority, it'll still run as "NOBODY".

However, in the PHP script you could do this:

$conn = i5_connect( $_SERVER['HTTP_X_FORWARDED_SERVER'],
strtoupper($_SERVER['PHP_AUTH_USER']),
$_SERVER['PHP_AUTH_PW']);

At least then, any i5_xxx routines will run under the appropriate user/password.

Peter Connell wrote:

Perhaps I am missing the point of this but if the task is to provide
a web page the can only be used by an AS400 profile then this is
commonly achieved by setting the Apache configuration to require that
such pages are protected by the AS400 system password file (
PasswdFile %%SYSTEM) and assigning Basic Authentication (AuthType
Basic). By also setting these requests to run as UserID %%CLIENT%%
then the HTTP server takes care of security automatically and any
server-side functions performed by the web page will already have
been authenticated by the HTTP server and can be trusted to execute
under profile designated by the server in the REMOTE_USER environment
variable which can be passed to any user defined routine.