I am building a PHP application and would like to lock the backend (even login page) to only be accessible to preauthorized people - even further be able to link activities to the authorized individuals.

I am aware that such locking may be done using SSL or a certificate of sort but not certain or how to achieve it. I have seen different companies implement it in ways as mentioned below

  • At one company, A user fills in a form with details and the company issues a certificate that the user installs on the browser in order to access the backend

  • Another company, A user is given an exe to run each time they want to access the backend.

My PHP application is running on windows server 2016 and I would like to know how to achieve both or either of the above. A resource or specific would be appreciated.

closed as off-topic by Tobi Nary, Rory Alsop Aug 20 '17 at 21:03

  • This question does not appear to be about Information security within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.


...would like to lock the backend (even login page) to only be accessible to preauthorized people

This suggests that you want two layers of authentication + authorization. In most cases, this is an indication of poor design, though there might be exceptions. One big drawback is that you have two separate authentication systems i.e., two separate IDAMs managing a single identity - which only adds to weaknesses, not strengths. Using a single IDAM for two layers of authentication is also wasteful.

However, if you still want to go ahead:

The most common method of doing this is by restricting the application to a private network (or a virtually private network). By controlling access to the network, you restrict access to the Login Page and the rest of the application.

Whether you do it with client-side certificates or some other mechanism is up to you. You will need to study implementations/products in the categories of Network Access Control and/or VPNs.

Use of client-side certificates (usually device certificates, but could also be person-specific) is not uncommon with VPNs, though most installations rarely ever go beyond shared secrets and individual passwords.

Your bullet point #1 is a specific way of managing the start of the identity lifecycle while issuing certificates.

Point #2 (exe) seems an ugly hack, though it could just be an authentication agent that hides the complexity. If so, I suspect that it would be terribly insecure unless it involves use of some other (classic) user/device specific authentication steps.

  • I highly appreciate your response, will try post here with a how implement in the future – Erick Aug 20 '17 at 18:14
  • @Erick note that this answer has nothing to do with PHP, Windows, or the application at all. It simply says to restrict access to the app by restricting access to the network the app or backend runs on. – schroeder Aug 20 '17 at 18:23

Not the answer you're looking for? Browse other questions tagged or ask your own question.