Authentication in Windows as per Linux 2

[ratnapokharel]

We have two servers, one linux and one windows. LInux is our main web server and has all the user authentication. Windows is oracle 9ias web server that has some php files
to diplay oracle dynamic data. Those php files are accessed by the same user in Linux.
Customers log in to linux and see thier index page that has links to 9ias php pages and they run the reports.

But if they copy the hyperlink and run it without logging into linux they can still access and run those php files because there is no authentication in windows.
So
1) we want customers not be able to run windows php files without linux authentication.
2)How to know in windows that somebody has already been authenticated in linux, are there any tokens that can be passed or checked?

 

[DRJ478]

I would consider a front-end back-end server configuration in which the back-end only accepts connections from the front-end. That would involve some system programming but is probably worthwhile.
I don't know much about the Windows side, but the front-end proxy with Linux and Apache should be fairly easy to be configured.

 

[Bastien]

Set a cookie whe the user logs on, store the cookie value in the db...make it a random value string, so that even if they copy it, the program won't allow access. Write something like the pseudocode below, and include it in each report file...

//on the oracle machine
$auth = $_COOKIE['authenticate'];

//run query to check value of cookie
//if match then allow user access
//if no match, redirect to the linux server

A better solution is to have all the php code on one webserver and use PHP to access the oracle db...then authentication is not a worry and sessions can be better utilized to make things work more smoothly

Bastien

Cat, the other other white meat

 

[ratnapokharel]

HI DRJ478, Thankx
Can you give some idea how to configure?I am fairly new in this configuration.

Otherwise I have to go with Cookie as mentioned by Bastien
.

 

[ratnapokharel]

our company does not want to cookies because many people disable it. So is there a better way??
Can somebody help?

 

[DRJ478]

I'll get back to you with more details about the proxy.
Let me know, what version of Apache are you using?

 

[Bastien]

if no cookie attach a variable to the url, create the url on th efly with this element, and place it into the db, similar to the cookie...

<a href="/myreport.myserver.com?my_id=3154845218>Click for report</a>

expire the value after some pre-determined time has lapsed, half hour hour, whatever

Bastien

Cat, the other other white meat