Re: web app security - user profile or validation list?

[Bradley Stone <bvstone@xxxxxxxxx>]

So you want to link a non-IBM i profile to an actual IBM i profile?

So if JOESMITH signs in, and doesn't have an IBM i profile you link it to
another ID?

Bradley V. Stone
www.bvstools.com
MAILTOOL Benefit #17 <https://www.bvstools.com/mailtool.html>: Compatible
with Google/Gmail/G Suite, Outlook.com, Microsoft Office 365 as well as
most other SMTP servers and relays. No tricks, gimmicks or relays needed.
MAILTOOL is set up just like a PC or mobile device with the appropriate
outgoing mail router information and well as the proper authentication.

On Tue, Aug 21, 2018 at 10:53 AM Steve Richter <stephenrichter@xxxxxxxxx>
wrote:

> not sure how users should login to a PHP web page and access the IBM i
> database. Are there good solutions?
>
> Initially I was using basic authentication. The browser would prompt for
> user name and password.  The PHP code would then store the user name and
> pass in $_SERVER variables.  PHP_AUTH_USER and PHP_AUTH_PW.
>
> This worked.  But the process is a bit confusing. But more so, what to do
> when adding a web user who does not have an IBM i user profile?
>
> So I changed to using validation lists.  Which are easier to work with in a
> SPA type web page. And the login prompt is a bootstrap modal that looks
> better.
>
> The problem with validation list is how to run code on the server under the
> IBM i user profile of the web user?  I know about the QSYGETPH and QWTSETP
> APIs which allows a job to change its user profile.  But you need the
> password of the user to do this. Where to securely store the password?  Or
> give QTMHHTTP authority to switch to a user profile without the password.
> Which means any code running in PHP can switch to another user profile?
>
> Is there guidance from IBM on how to limit access to tables and programs to
> specific user profiles when running PHP web code?
> --
> This is the Web Enabling the IBM i (AS/400 and iSeries) (WEB400) mailing
> list
> To post a message email: WEB400@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: https://lists.midrange.com/mailman/listinfo/web400
> or email: WEB400-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at https://archive.midrange.com/web400.