2

I am going to be using a Symfony SMB Bundle like this to browse a Windows File System through PHP.

To do this - I'll create a Web API that will return a list of files and directories in a directory so you can browse through the contents of a network share.

As I'll need to authenticate with LDAP each time I make the connection, what is the best way to send the LDAP username and password of the user each time?

Is it safe to store a private key on the server in a database against the username, that is used to encrypt a string e.g. (username:password:timestamp:ipaddress) and then have the client sends that encrypted string with each request using HTTPS for the server to then decrypt and use the credentials - after each request the private key will be changed. If the timestamp has expired it'll reject it, if the IP address does not match it'll reject it etc.

Or is there a better / more secure way to authenticate with credentials each time without the user having to re-enter for every request?

3

First thing you should do is check to see if there is anything exist you can use instead of trying to roll your own authentication / authorization framework. Going web? Then look at OAuth 2.0 or OpenID. If you have to roll your own then:

Avoid sending credentials if you can - instead send a token that can be used to verify the credentials. Signed token with a hash value that can be used to represent the secret.

Once your token is generated cache it on the client in a secure manor and send per request.

4
  • Thank you for the comment - The problem I have is with each call to my api - it has to re-authenticate with smb - to make a connection to the file server and get the new file/directory list - Does this mean I have to store their LDAP credentials server-side while they are logged in? - I hope I am making sense. – Daniel Few Jan 22 '18 at 20:56
  • Link to SMB api to hopefully add context: github.com/icewind1991/SMB - with each request I have to reconnect with $server = new Server('localhost', 'username', 'password'); - unless there's a way I can make that connection once and store it for future use with the users credentials. – Daniel Few Jan 22 '18 at 20:57
  • If you are using a framework then you are limited to what it allows. Is this on the same network - could use use windows auth and just rely on it sending the NTLM hash? – McMatty Jan 22 '18 at 22:32
  • What I want to be able to do is read and write files to a windows network share from outside the domain - through a web application. The problem is - This would be 'easy' if I gave the IIS user full read and write access to every file on the network - and then through code handle permissions (however this would mean my web app is handling security which I don't want - I want to use the already existing windows permissions - so ideally I need to do things like 'list contents of directory' server-side AS the user that has authenticated. I really hope that makes sense! – Daniel Few Jan 23 '18 at 15:06
0

I believe in theory you could get a Kerberos ticket for the credentials and use that to access the file service, however although Microsoft is increasingly adopting open protocols, not all the APIs are exposed, and what little documentation exists uses very proprietary terminology. So in practice that's not going to work.

Creating a Daemon instance to hold the SMB session open between http requests is a non-starters, although using web sockets to maintain a persistent connection is workable, but this requires you to implement much more of your app in JavaScript and requires a lot of custom code to manage the servers.

I'd just go with good old-fashioned http.

So you need a means of recovering the cleartext of the SMB password for each request, but for good security you don't want the cleartext to persist between requests. One way to achieve that would be to store the encrypted password on the server (optionally packaged up with other metadata) using a key stored on the client (but sent with every request - e.g. a cookie). This is actually quite easy to do with a custom session handler in php.

Here's one I prepared earlier.

1
  • (When I say "good old fashioned http" I do mean over TLS!) – symcbean Mar 24 '18 at 0:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.