Authenticate User's Unix Credentials via Web Browser

Question

Can anyone give me tips on how to authenticate a user's Unix credentials through the browser?

I am basically giving access to some file viewing and I want to make sure the users are authenticated but don't want to make a whole additional password and username that they have to remember.

Answer 1

There are few transparent methods for this, unfortunately.

• In a centrally managed network, you could possibly use Kerberos, with mod_auth_gssapi or mod_auth_kerb on the web server side (aka "HTTP Negotiate"). Kerberos is very secure, but can be a pain to configure for web usage (not all browsers support it, and only some allow it by default).

• If all the computers are trusted (i.e. users are guaranteed to not tamper with root-installed software), the Ident protocol (RFC 1413) is a possibility, but the authentication it provides is very weak.

But most often, your only option is to ask for a password.

• If the users have accounts in /etc/passwd, as mentioned in your comment, running a privileged program is unfortunately the only way to verify a received password against /etc/shadow.

  If you do this, don't write your own scripts through sudo, because you will get input validation wrong the first time, and because it's a solved problem already. Pick something well-known, for example Cyrus saslauthd (which can run in -a pam mode); that way your website will not need any privileges beyond connecting to the saslauthd socket.