将用户凭据安全地存储在数据库中，用于 PHP Web 应用程序
我构建了一个 Web 应用程序，现在需要存储用户凭据以访问另一个系统。 （尽管我不想这样做，但不幸的是我在这件事上别无选择。）
我的 Web 应用程序通过 LDAP 与 Windows 域控制器交互以验证用户帐户。因此，当用户登录我的应用程序时，应用程序会检查 LDAP 以确保他们是有效用户并且密码正确。一旦通过身份验证，就会从 MySQL 数据库加载用户的各种数据。
现在，我需要以某种方式在这个数据库中存储另一个系统的用户名和密码，我正在探索最安全的方法来做到这一点。
我考虑过的一种方法是使用用户的域密码（由 LDAP 验证）作为加密密钥来加密另一个系统的凭据。这样，如果有人确实以某种方式获取了数据库，那么它就没有多大用处，因为每个记录都将使用不同的（希望无论如何）密钥进行加密，并且该密钥不会出现在 Web 应用程序本身的任何位置。此方法的问题在于，当用户更改密码时，为其他系统保存的凭据不再有效。然后我必须再次提示输入其他系统凭据。我不反对这样做，只要没有其他方法。
有什么想法吗？感谢您抽出时间。
编辑：我刚刚想到的其他事情是基于 LDAP 公开的其他一些数据进行加密。 objectGUID 是一个看起来很有前途（但对于域中的任何人来说也可能不安全）的值，我认为它是帐户的 GUID。我可能会使用这个加密密钥。域用户或其他人很容易找到它吗？
编辑#2：我发现任何域用户都可以通过 LDAP 轻松查找 GUID，因此我决定不再使用该方法。我可能必须根据用户密码进行加密，除非有其他建议。
I have a built a web application that now has a requirement of storing user credentials for access to another system. (As much as I would like to not do this, unfortunately I have no choice in the matter.)
My web application interfaces with a Windows domain controller over LDAP to verify user accounts. So, when the user logs into my application, the application checks LDAP to make sure they are a valid user and their password is correct. Once authenticated, the users' miscellaneous data is loaded from a MySQL database.
Now, I need to store a username and password for this other system in this database somehow, and I am exploring the most secure way to do it.
One method I have considered was encrypting the credentials for this other system using the users' domain password (as verified by LDAP) as the encryption key. This way if someone did get the database somehow, it wouldn't be of much use as each record would be encrypted with a different (hopefully anyway) key, and that key wouldn't be present in the web application itself anywhere. The problem with this method is that when the user changes their password, the saved credentials for the other system are no longer valid. I would then have to prompt again for the other system credentials. I am not opposed to doing this, provided that there isn't another method.
Any thoughts? Thank you for your time.
Edit: Something else I just thought of was encrypting based on some other data exposed for LDAP. One value that looks promising (and also probably insecure to anyone on the domain) is the objectGUID, which I assume is the GUID for the account. I might use this the encryption key. Is this easy to find by domain users or others?
Edit #2: I have found that any domain users can easily look up the GUID via LDAP, so I have decided that method is out. I may have to encrypt based on the user password, unless there are other recommendations.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
您可能想看看这个其他系统是否支持任何标准的“单点登录”方式。这样您就不必重新发明轮子。
You might want to see if this other system supports any standard ways of doing "single sign-on." That way you don't have to re-invent the wheel.
在没有其他建议的情况下，我将简单地使用用户的密码加密辅助凭据。这并不理想（因为当他们更新数据时我会丢失数据），但对于目前我的特定项目来说应该足够了。
In the absence of other suggestions, I am going to simply encrypt the secondary credentials using the user's password. This isn't ideal (as I will lose the data when they update it), but should be sufficient for my particular project at the moment.