Logistics logistics
I am writing a set of applications, all of which require a server login. It matches very well, but I ran into a logistic problem. The nature of applications requires them to be closed and started later with some frequency. It is very annoying that you have to register every time one of the applications is launched.
I'm trying to think of a secure way, perhaps to have the login information stored on the user's local machine. Is there a good way to even go about this? Protected config file permissions? Registry? How does Firefox store its passwords? Have you ever had to do something like this?
A suite of more protocols than everything, all applications are written in different languages (Python, C #, Java, etc.) and run on different operating systems (Windows, Linux, OSX, etc.). I'm not really looking for code examples, but more general approaches to this problem. Is it correct to have locally stored passwords? How can you have a dial-in session login with such disparate components? Right now I am using .rc application config files stored locally for each application, but they are plain text and far from secure.
a source to share
I'm going with Jeff on this one and assume that since you mention the registry, you mean Windows. I'm also assuming you're talking about a desktop app (otherwise you could just use the built-in browser cookies to store the user's session).
To the head, I would develop an application so that when a user logs into the server, the server will return a unique session ID that identifies the authenticated user. I would then store the ID along with the broken timestamp (which gives you the option to expire the cached credentials).
The storage engine is up to you. They can be saved in the HKEY_LOCAL_USERS key in the Windows registry or in the Application Data folder in Windows. Both give you the option of a segmented segment of users.
a source to share
Typically, this kind of thing is done with a cookie; the key (which is safe) indicates that the user has successfully logged into the server resource. Thus, most websites manage registration information, and Firefox (actually all browsers) store cookies that browsers set when they log in. A few important points about cookies: they must be encrypted to ensure that malware cannot generate them and thus bypass the login process, they must match the resources supported by the server (for the same reason) and they must increase, so while you can maintain the login information on the site for a while, your login information is not permanent (this is another security hole).
a source to share
Personally, I would use an encrypted local config file with some sort of machine ID (motherboard ID, chip ID, HD ID, etc.) as part of the encryption key so that the config file isn't just copied from one machine to another. I would also like to include a date and time so you can end it when you think it is out of date.
Alternatively, you can create an exe or launcher host that logs in and then goes to sleep and wakes it up every time you want to start a new application. The exe host will take the application as a parameter and decide whether to prompt for login credentials (usually when the first application starts and then stores the login user and encrypted password in memory. When the exe host leaves the login information is forgotten and when you start again, the cycle begins.)
a source to share
Tomcat 6 supports session persistence / replication, so you have to take care of choosing a manager and setting it up; -)
More information: http://tomcat.apache.org/tomcat-6.0-doc/config/manager.html
a source to share