Re: Apache authentication efficiency

In regard to using a web portal for authentication, authorization, and
access to menu items, try this example:

http://mv.radile.com/


User ID: SPECIALIST
Password: specialist

That user is authorized to a menu and a couple of menu items that appear in
the browser after successfully authenticated via a login request.

Authentication only happens once, via the login process. Users navigate
menus and launch items that they are granted authority to. When users click
on menu items, a session (an IBM i Job that runs separately from the HTTP
server is started). Those Jobs support the individual user's requests until
the Exit link is clicked, or the session expires due to inactivity, which
causes the Job to end. This interface is somewhat comparable to 5250 in
that session state is maintained in a Job. The IBM i HTTP server is used
only for I/O between the browser and the IBM i Job, comparable to how
Telnet is used to communicate between a 5250 emulator and an IBM i session
(Job).





On Wed, Jan 29, 2020 at 1:00 PM Nathan Andelin <nandelin@xxxxxxxxx> wrote:

My understanding is the same as yours in that when you add HTTP
authentication directives to your HTTP configuration, then all requests for
protected resources are passed through the authentication module. That
module not only authenticates the user, but also checks the user's
authority. It may also change the job to adopt the user profile. I agree,
that's not very efficient.

It can also be more costly in that all users need a client license in
order to authenticate against IBM i. That may only be a problem if you want
to open your site to the public.

One alternative is to use an IBM i web portal, which enables you add user
profiles to the portal that are not associated with an IBM i authentication
resource (IBM i User Profile, LDAP entry, authorization list entry,
Kerberos entry). A web portal is an application that maintains user
profiles, user groups, menus and menu items, user and group authorities,
etc. Users are authenticated only once when accessing the application. User
authority is then checked when accessing menus. When a menu item is
selected, and its associated session is launched, there is no need to
authenticate while using the application.



On Wed, Jan 29, 2020 at 11:28 AM Justin Taylor <JUSTIN@xxxxxxxxxxxxx>
wrote:

It's my understanding that Apache offer Basic and Kerberos
authentication, and authentication is repeated for every subsequent
request. That seems inefficient to me. Are there more efficient methods
for authentication?

TIA
--
This is the Web Enabling the IBM i (AS/400 and iSeries) (WEB400) mailing
list
To post a message email: WEB400@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/web400
or email: WEB400-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/web400.