Re: PHP - authenticate and authorize using AS400 profile

[Peter Connell <Peter.Connell@xxxxxxxxxxxxxxxxx>]

I obviously need to become more familiar with the Zend architecture on i5.
I'm still wearing my traditional CGI hat.

Peter

-----Original Message-----
From: web400-bounces@xxxxxxxxxxxx [mailto:web400-bounces@xxxxxxxxxxxx] On Behalf Of Scott Klement
Sent: Monday, 9 November 2009 12:01 p.m.
To: Web Enabling the AS400 / iSeries
Subject: Re: [WEB400] PHP - authenticate and authorize using AS400 profile

UserID %%CLIENT%% doesn't work with Zend Core because the PHP is 
actually running in a separate instance of Apache that runs in PASE.  So 
the UserID directive in the native Apache has no effect.

You could code the UserID directive in the PASE instance, but can't use 
the value %%CLIENT%% because it's compiled for AIX and it doesn't 
understand IBM i user profiles and passwords.

You *can* use PasswdFile %%SYSTEM%% on the proxy, and provided that the 
PASE instance is only bound to localhost, that will force a valid 
userid/password before the PHP script is invoked.  But it won't run with 
the user's authority, it'll still run as "NOBODY".

However, in the PHP script you could do this:

$conn = i5_connect( $_SERVER['HTTP_X_FORWARDED_SERVER'],
                     strtoupper($_SERVER['PHP_AUTH_USER']),
                     $_SERVER['PHP_AUTH_PW']);

At least then, any i5_xxx routines will run under the appropriate 
user/password.

Peter Connell wrote:
> Perhaps I am missing the point of this but if the task is to provide
> a web page the can only be used by an AS400 profile then this is
> commonly achieved by setting the Apache configuration to require that
> such pages are protected by the AS400 system password file (
> PasswdFile %%SYSTEM) and assigning Basic Authentication (AuthType
> Basic). By also setting these requests to run as UserID %%CLIENT%%
> then the HTTP server takes care of security automatically and any
> server-side functions performed by the web page will already have
> been authenticated by the HTTP server and can be trusted to execute
> under profile designated by the server in the REMOTE_USER environment
> variable which can be passed to any user defined routine.