Re: IBM i authentication and RESTful web service design

[Scott Klement <web400@xxxxxxxxxxxxxxxx>]

Kelly,

If you have SSO already set up (such as LDAP, etc) then you can 
configure Apache to use it.  You would add something like this to your 
config file for LDAP support:

LoadModule ibm_ldap_module /QSYS.LIB/QHTTPSVR.LIB/QZSRVLDAP.SRVPGM

<DirectoryMatch "^/QSYS\.LIB/YOURLIB\.LIB/[a-z0-9]*\.PGM">
    LDAPConfigFile /www/YOUR-HTTP-INSTANCE/conf/ldap.prop
    PasswdFile %%LDAP%%
    AuthType Basic
    AuthName "Kelly's Service"
    Require valid-user
</DirectoryMatch>

With this, Apache will accept any userids in the LDAP server to sign on. 
 Your application would use the EIM APIs to find the "actual" userid to 
use on the IBM i side of things, if that's necessary.  You don't have to 
have userids for every user if you don't want, you can use EIM to map 
your userids to a generic user profile on the IBM i side if you want.

To answer your questions:

1) True if you want to be 100% perfectly stateless, you'd send the 
credentials each time.  If you use the above method, you'd do that using 
basic authentication, which is supported automatically be all web browsers.

If you don't like the credentials sent on every request (the main 
problem with that is security.  If you're not using SSL/TLS to encrypt 
the session, the more times you send the credentials, the more likely 
they'd be intercepted...)  Then you could do something like generate a 
unique session ID on the first request, and then re-send that with each 
subsequent request.  That's not 100% stateless, and would require a lot 
more work, but it does give you more control over how the authentication 
process works (because in this case you would not let Apache handle it, 
you'd do it all yourself i your Cobol or other HLL code.)

But, from what I've seen letting Apache handle it suffices for most 
business applications.  And using SSL/TLS protects the contents, so the 
danger of being intercepted becomes a non-issue.... and it's a lot 
easier that way.

2) I'm sure there must be some performance hit, since it has to look up 
the credentials with each request -- but, honestly, it's been so fast 
for me that I have never noticed it.

Good luck



On 5/14/2015 12:24 PM, Kelly Cookson wrote:
> I am trying to understand in-depth how to develop RESTful web services using CGI programming on the IBM i.
>
> I am using Fielding's dissertation (https://www.ics.uci.edu/~fielding/pubs/dissertation/fielding_dissertation.pdf) as my primary source for what constitutes REST architectural constraints. One constraint is statelessness. On pages 78-79 of his dissertation, he writes:
>
> "We next add a constraint to the client-server interaction: communication must be stateless in nature...such that each request from client to server must contain all of the information necessary to understand the request, and cannot take advantage of any stored context on the server. Session state is therefore kept entirely on the client."
>
> "This constraint induces the properties of visibility, reliability, and scalability. Visibility is improved because a monitoring system does not have to look beyond a single request datum in order to determine the full nature of the request. Reliability is improved because it eases the task of recovering from partial failures. Scalability is improved because not having to store state between requests allows the server component to quickly free resources, and further simplifies implementation because the server doesn't have to manage resource usage across requests."
>
> The IBM i requires every person or system that accesses it's resources to provide a user name and password. Consequently, it seems to me the client has to store credentials associated with a session, so the user doesn't have to fill out  a new login form for each request to the server. It also seems to me the client has to pass user credentials within each request it makes to a web service on the IBM i that uses CGI programs.
>
> Here are my questions:
>
>
> 1.       Am I mistaken that stateless communication requires clients to pass user credentials on each request to the server? If not, how do you avoid passing user credentials on each request while keeping all session information on the client? Maybe I'm missing something obvious. (I'm still a newbie in this area.)
>
> 2.       What kind of performance hit, if any, does one take by having to pass user credentials with each request to the IBM i?
>
>
> 3.       Does anyone have suggestions from personal experience, or know some good resources to read, regarding user authentication for web services built on RPG/COBOL CGI programs?
>
> Thanks,
>
> Kelly Cookson
> IT Project Leader
> Dot Foods, Inc.
> 1.217.773.4486 ext. 12676
> kcookson@xxxxxxxxxxxx<mailto:kcookson@xxxxxxxxxxxx>