Re: Impersonating a user profile from PHP, Python or other web language

Just to add to this - it's dependent on an initial authentication by a trusted service - in Windows that is usually an Active Directory server - these exist in other OS' and can maybe be done on IBM i using IBM Directory Services, which is an LDAP server. Now I'm kind of guessing on that - there are systems that don't use Windows that have key distribution centers for Kerberos authentication.

When you set up Network Authentication Service on i, you specify what is the KDC and some other stuff - again, it doesn't have to be a Windows AD server.

It's all kind of a "Joe sent me" speak-easy kind of thing.

Good luck
Vern

On 10/17/2015 9:21 PM, Justin Dearing wrote:

Thanks. Now that I know what to google for, I'll do some more research,
then contact him if I need more help.

Justin

On Sat, Oct 17, 2015 at 10:12 PM Vernon Hamberg <vhamberg@xxxxxxxxxxxxxxx>
wrote:

Kerberos for single-sign-on is available on i - it's called Network
Authentication Service - and there is an identity-mapping facility
called EIM or Enterprise Identity Mapping - this lets you have different
user names in different context, and if you have an identity that is
authenticated by some KDC - is that the term in Kerberos for key
distribution center? If you have that identity that is now trusted, EIM
lets map to an identity in YOUR context that has certain authorizations.

APIs exist for this on IBM i and are actually out there for Windows and
AIX and maybe Linux.

If you want to know stuff from the guy who led the team that wrote a lot
of this, go to http://www.botzandassociates.com/ - the "contact us" page
has and email that is Pat Botz' or will get you to him. Go ahead and say
I sent you - he had helped me a lot with a project enabling an
application for SSO a few years ago. He does contract out for SSO
installations but may give you some time and information.

HTH
Vern

On 10/17/2015 8:42 PM, Justin Dearing wrote:

Hello,

I'm contemplating writing a REST service for dealing with source members
that would work on any IBM i. Naturally, security is important here, and
I'd want things to run with a users user profile, not the user profile

that

apache is running in.

So, each language has an ibm_db module with connect/pconnect calls that
will either take a trusted context as the user PHP runs as, or a user

name

and password. The XML service seems to require a name and password.
Ideally, I want the users to transmit names and passwords once to get a
token, and then use that token for the rest of their session. Or even

more

ideal would be something like kerberos where there were time sensitive
tickets.

Do I have this option on the IBM i? This is pretty important to me for

this

project. I'd pick my language for this particular project solely on who

has

the best security model for impersonating real user profiles.

BTW my ultimate goal once I wrote the REST API would be to morph it into

a

WEBDAV implementation thats good enough for windows and MACs to mount and
most text editors to edit the files directly. Another solution, hardest

for

me to write, and completely out of scope of web programming would be a
module for SAMBA to expose source members as a UNC mount. If any of these
things exist, please tell me so I don't waste my time. I have plenty of
windmills to tilt.

Justin

--
This is the Web Enabling the IBM i (AS/400 and iSeries) (WEB400) mailing
list
To post a message email: WEB400@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/web400
or email: WEB400-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/web400.