views:

68

answers:

1

Hi,

We do have a client software which communicates to a server. On every start of the client the user has to put in username/password. Now it would be nice if the user did login once (assuming he is still in the same operating system session) subsequent logins wouldn't require a password. (Sidenote: the security requirements aren't really high, so this would be okay). Is there some unique id which the client can extract from the system that ids the session? If yes the server could save the session id and if it is the same we wouldn't need to ask for a password.

Thanks in advance.

P.S.: Keberos is an overkill in that case…

A: 

Isn't this why god invented Cookies?

Christian W
i think the question is not about webserver/browser, but custom made software
knittl
right I could use some kind of cookie, but then the question would be where to place it so noone else can access it (In theory the users homedir should be only readable by him, but well…).
Florian Apolloner
@Florian: note that the "unique id which the client can extract from the system" would be even more public. If one user can, probably all users can. At least for your cookiefile you can set the permissions to 700, which will overrule any read access to the users' homedir.
MSalters
@MSalters: not necessarily, if the system does provide this id it could guard it against others as well. But yeah, I guess I'll go with the cookiefile.
Florian Apolloner