Re: [webmin-devel] Creating a valid login cookie for Webmin

On Fri, 2004-07-23 at 08:16, Achton N. Netherclift wrote:
> Hi all,
> 
> I would like to create my own login page for my users. The purpose is 
> for this login page to act as a single sign-on point for all the systems 
> that are available to them. This includes Webmin 1.080 (well, Usermin 
> really, but I assume the authentication system is the same).
> 
> I've been spending several hours now, trying to figure out the Perl 
> scripts (Perl is not my cup of coffee), and how they manage the cookie 
> validation. Since I'm doing this in PHP, I need my page to create a 
> valid cookie for the user and somehow drop this in Usermin's path, so 
> that it seems like they are alread validated.
> 
> I can figure out the cookie name, path, domain and so on. I can login to 
> Usermin, change the cookie info or delete it, check that Usermin asks 
> for login again, restore the cookie info, and go back and see that 
> Usermin authenticates me again.
> 
> However, I need to do this in reverse order. That is, create the cookie, 
> send it to the user, and then over to Usermin.
> 
> I'd think that I have to manipulate some file on disk that stores the 
> session information, but I have no clue as to where to look.
> 
> I have looked in miniserv.pl, though, and found the part that handles 
> the SID for correct login. I supposed I might have to intercept this 
> part, and tell the main process about this SID myself, thus "fooling" 
> Usermin into thinking that the user is already authenticated.
> 
> Am I way off here, or could someone point me in the right direction?

The proper way to create a valid session cookie is to add it to the DBM
file /var/webmin/sessiondb. This could be done with Perl code like :

$sid = "12345";
$username = "admin";
$now = time();

dbmopen(%sessiondb, "/var/webmin/sessiondb", 0700);
$sessiondb{$sid} = "$username $now";
dbmclose(%sessiondb);

You can now set the cookie sid=12345 in the browser, which will then be
allowed access to Webmin.

 - Jamie




-------------------------------------------------------
This SF.Net email is sponsored by BEA Weblogic Workshop
FREE Java Enterprise J2EE developer tools!
Get your free copy of BEA WebLogic Workshop 8.1 today.
http://ads.osdn.com/?ad_id=4721&alloc_id=10040&op=click
-
Forwarded by the Webmin development list at [email protected]
To remove yourself from this list, go to
http://lists.sourceforge.net/lists/listinfo/webadmin-devel