Sending Credentials On Each Request

Question

I am going to be using a Symfony SMB Bundle like this to browse a Windows File System through PHP.

To do this - I'll create a Web API that will return a list of files and directories in a directory so you can browse through the contents of a network share.

As I'll need to authenticate with LDAP each time I make the connection, what is the best way to send the LDAP username and password of the user each time?

Is it safe to store a private key on the server in a database against the username, that is used to encrypt a string e.g. (username:password:timestamp:ipaddress) and then have the client sends that encrypted string with each request using HTTPS for the server to then decrypt and use the credentials - after each request the private key will be changed. If the timestamp has expired it'll reject it, if the IP address does not match it'll reject it etc.

Or is there a better / more secure way to authenticate with credentials each time without the user having to re-enter for every request?

Answer 1

First thing you should do is check to see if there is anything exist you can use instead of trying to roll your own authentication / authorization framework. Going web? Then look at OAuth 2.0 or OpenID. If you have to roll your own then:

Avoid sending credentials if you can - instead send a token that can be used to verify the credentials. Signed token with a hash value that can be used to represent the secret.

Once your token is generated cache it on the client in a secure manor and send per request.

Answer 2

I believe in theory you could get a Kerberos ticket for the credentials and use that to access the file service, however although Microsoft is increasingly adopting open protocols, not all the APIs are exposed, and what little documentation exists uses very proprietary terminology. So in practice that's not going to work.

Creating a Daemon instance to hold the SMB session open between http requests is a non-starters, although using web sockets to maintain a persistent connection is workable, but this requires you to implement much more of your app in JavaScript and requires a lot of custom code to manage the servers.

I'd just go with good old-fashioned http.

So you need a means of recovering the cleartext of the SMB password for each request, but for good security you don't want the cleartext to persist between requests. One way to achieve that would be to store the encrypted password on the server (optionally packaged up with other metadata) using a key stored on the client (but sent with every request - e.g. a cookie). This is actually quite easy to do with a custom session handler in php.

Here's one I prepared earlier.