Re: web app security - user profile or validation list?

As Justin said - if you use a slightly different URL for different types of users then the Apache server will take care of it.

Whether you use normal IBM i user profile login or a validation list or "roll your own" authentication can be controlled by URL used.

Reading the standard Apache docs won't help a lot in this regard as the use of a regular user Id is an IBM addition.


Jon Paris

www.partner400.com
www.SystemiDeveloper.com

On Aug 22, 2018, at 2:54 PM, Steve Richter <stephenrichter@xxxxxxxxx> wrote:

On Wed, Aug 22, 2018 at 1:43 PM, Justin Taylor <JUSTIN@xxxxxxxxxxxxx> wrote:

True. He needs to have it both ways.

I wonder if there's a way in your Apache config to have authentication use
either user profile or validation list authentication? You could probably
get there by using different URL's. Of course, the validation list users
would still be anonymous for authentication and journaling. You could do
DIY logging to record what validation list users do, and control what they
can access.

I would have all the validation list users linked to an IBM i user
profile. Some are grouped to generic user profiles. Like trade show
users. Or customers who access their orders and browse product info. But
most users I want to login and run as their individual IBM i user profile.
--
This is the Web Enabling the IBM i (AS/400 and iSeries) (WEB400) mailing list
To post a message email: WEB400@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/web400
or email: WEB400-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/web400.