Re: user credential authentication and persistence

Here is some code that Enrico Zimuel wrote that allows you to encrypt import session data, such as passwords.

http://www.zimuel.it/en/encrypt-php-session-data/

Kevin Schroeder
Technology Evangelist
Zend Technologies, Ltd.
www.zend.com
www.twitter.com/kpschrade
www.eschrade.com
Skype: kevin.schroeder









-----Original Message-----
From: web400-bounces@xxxxxxxxxxxx [mailto:web400-bounces@xxxxxxxxxxxx] On Behalf Of Glenn Hopwood
Sent: Thursday, September 22, 2011 7:31 AM
To: Web Enabling the AS400 / iSeries
Subject: Re: [WEB400] user credential authentication and persistence

Sheldon,

Do you really need to store the password?

In our environment we have an LDAP server that all users are in, so we
use that for authentication. We then store only their user profile in a
session variable. We use a generic profile/password from a config file
for database access.

Glenn

On 9/21/2011 2:45 PM, Sheldon Foster wrote:

I would sure appreciate some advice.



I've been programming in rpg for a few years and have some exposure to php,
but am still in the learning process. I am trying to get a feel for what
the best practices are for getting login information from a user and then
maintaining that throughout the application.



These are the questions I have:

1) Is there a preferred method for validating a username/password
combination? I know of the following ways but am not sure of their
pros/cons (other than in both cases a user could accidentally/purposefully
disable another user's login):

a. Simply testing a connection using the user/pwd that was passed
using POST (filtering it first of course for any injections, etc.).

b. Using the rpg api QSYGETPH (get profile handle), check if a profile
handle is returned and if so then authentication is successful.

2) Is storing the username/password as session variables sufficient
(especially if they are encrypted)?

a. I know there is a php function called mcrypt. Would it be
sufficient to use this function alone to encrypt these variables?

b. Someone here on midrange.com suggested using the Zend framework to
extend the Zend_Session_Namespace in conjunction with mcrypt to accomplish
this. My problem with this method is that we aren't really using the
framework at this point (we may in the future), but I am wondering what this
method has over a simple use of the mcrypt function alone.

3) Searching online, some have recommend storing the user credentials
in a database file instead of session variables. What are the pros/cons of
this compared to using session variables?



Thanks for your time and expertise!



Sheldon