如何在Perl Dancer应用程序中改进身份验证

Question

I am working on a Perl Dancer web application that needs to accomplish two things in terms of authentication:

1. authenticate users based on Active Directory for access to the application
2. authenticate as the user to access a couple of .NET web services.

The application is being hosted as a CGI application by Apache on a Linux box, and I do not have much control over Apache's configuration.

Below is the workflow of the currently working application:

1. Display a login page to the user
2. When the user submits the form, use Authen::Simple::ActiveDirectory to verify the account is valid
3. Store the user's credentials using Dancer::Session::Cookie (encrypted cookies)
4. Display a search form to the user
5. When the user submits this form, use Authen::NTLM and SOAP::Lite to access the .NET services (similar to the example here ) to perform a search
6. Display the results to the user

The handling of user credentials here concerns me, but I am generally new to web applications and authentication. For a small internal application, is this okay? If not, how do you suggest I improve this process? Like I said, the application as outlined above works, but I feel like it could/should be improved.

Answer 1

One (part of a) solution could be that you let your apache webserver handle the authentication. You could use Kerberos for this. So only permitted users can access your application. In that case $ENV{REMOTE_USER} contains the username (eg foo.bar@MY.DOMAIN.COM).

If you need more information about the current user you can query your LDAP (containd in your Domain). I use a common (LDAP) user to get more information about the current user foo.bar@MY.DOMAIN.COM.

I know that this is only the fist part. I do not have experience useing/passing Kerberos tickets by SOAP. But if you mange to handle this, you have a clean SSO solution.

HTH

Answer 2

We do this in the Apache config. It requires something like the below. You'll need a read only password-less user to bind to Active Directory.

    AuthName "Active Directory"
    AuthType Basic
    AuthBasicProvider ldap
    AuthLDAPUrl ldap://server:389/OU=COMPANY,DC=COMPANY,DC=com?sAMAccountName,mail,name,extensionAttribute2,memberOf?base?(objectClass=user)
    AuthzLDAPAuthoritative on
    AuthLDAPBindDN "CN=ReadOnlyUser,OU=ServiceAccounts,OU=Users,OU=XXX,OU=COMPANY,DC=COMPANY,DC=com"
    AuthLDAPGroupAttributeIsDN on 
    require valid-user