Authentification with Java, PHP, .htaccess
Hi there,
I am thinking about creating a Java project that requires some authentification routines.
Users (which are given a unique user ID) are employing a client software (Java) that retrieves specific data from a webserver (available ressources HTML, SSI, PHP, .htaccess).
A user should be able to use *any* client to get his data from the webserver, so unique client IDs are a non-option. Probably two users might even use two instances of the same client on the same machine (means, same IP).
I want this to be reasonably secure, so no plaintext protocol. I thought about something like a challenge - response architecture, BUT...
...how can I do this with only PHP (server) and Java (client) as options?
I dont need a polished, smooth, perfect solution - a rough idea will do. Are there any secret / public key architectures with ready-to-use PHP modules that are also implemented in Java? Or has anybody a completely different idea I haven t thought about yet?
Nice idea, but sorry, no SSL...
(I would have to upgrade my web hosting for that - it would give me Perl, Python, SSL etc. but cost about twice as much. Thats why I d like to handle this by PHP alone.)
I already made a draft design of some authentification architecture, but Id still need an encryption supported by both Java and PHP. Any suggestions?
Have a look on RFC 2617 from IETF (www.ietf.org). This RFC specifies two mechanisms for authenticated access to HTTP resources. .htaccess is based on these mechanisms. Unfurtonately, they are not secure enough. The first protocol, BASIC, sends clear text username/password. The second, DIGEST, sends digests of the username/password using a challenge-response scheme. The disadvantage of DIGEST is that the username/password needs to be stored in clear on the server-side.
What you could do, which is something I am currently working on myself, is to implement your own protocol, based on this RFC. This is possible because you are in control of both the clients and the server. It wouldn't be possible if standard browsers where used as clients.
Good luck!
/Christer
