将用户凭据安全地存储在DB中，用于PHP Web应用程序 [英] Securely storing user credentials in DB, for PHP web application

问题描述

我已经建立了一个Web应用程序，它现在具有存储用户凭据以访问另一个系统的要求。 （尽管我希望不这样做，不幸的是我没有选择的事情。）

I have a built a web application that now has a requirement of storing user credentials for access to another system. (As much as I would like to not do this, unfortunately I have no choice in the matter.)

我的Web应用程序与Windows域控制器通过LDAP验证用户帐户。因此，当用户登录到我的应用程序时，应用程序将检查LDAP以确保它们是有效的用户，并且其密码正确。一旦验证，用户的杂项数据从MySQL数据库加载。

My web application interfaces with a Windows domain controller over LDAP to verify user accounts. So, when the user logs into my application, the application checks LDAP to make sure they are a valid user and their password is correct. Once authenticated, the users' miscellaneous data is loaded from a MySQL database.

现在，我需要在这个数据库中存储这个其他系统的用户名和密码，而且我正在探索最安全的方法。

Now, I need to store a username and password for this other system in this database somehow, and I am exploring the most secure way to do it.

我曾考虑过的一种方法是使用用户的域密码加密这个其他系统的凭据（由LDAP验证）作为加密密钥。这样，如果有人以某种方式获取数据库，则不会有太多用处，因为每个记录将使用不同的（有希望的）密钥进行加密，并且该密钥不会在任何地方的Web应用程序中出现。此方法的问题是当用户更改其密码时，其他系统的已保存凭据将不再有效。然后我将再次提示其他系统凭据。我不反对这样做，只要没有其他方法。

One method I have considered was encrypting the credentials for this other system using the users' domain password (as verified by LDAP) as the encryption key. This way if someone did get the database somehow, it wouldn't be of much use as each record would be encrypted with a different (hopefully anyway) key, and that key wouldn't be present in the web application itself anywhere. The problem with this method is that when the user changes their password, the saved credentials for the other system are no longer valid. I would then have to prompt again for the other system credentials. I am not opposed to doing this, provided that there isn't another method.

任何想法？谢谢你的时间。

Any thoughts? Thank you for your time.

编辑：其他我刚刚想到的是根据公开的LDAP的其他数据进行加密。一个看起来很有希望的值（也可能对域上的任何人都不安全）的价值是 objectGUID ，我认为这是帐户的GUID。我可以使用这个加密密钥。域名用户或其他用户可以轻松查找这些信息？

Something else I just thought of was encrypting based on some other data exposed for LDAP. One value that looks promising (and also probably insecure to anyone on the domain) is the objectGUID, which I assume is the GUID for the account. I might use this the encryption key. Is this easy to find by domain users or others?

编辑＃2：我发现任何域名用户都可以轻松查找GUID通过LDAP，所以我已经决定该方法了。我可能需要根据用户密码进行加密，除非有其他建议。

Edit #2: I have found that any domain users can easily look up the GUID via LDAP, so I have decided that method is out. I may have to encrypt based on the user password, unless there are other recommendations.

推荐答案

在没有其他建议的情况下，我将使用用户的密码简单地加密次级凭证。这不是理想的（因为我们会在更新数据时丢失数据），但应该足以满足我目前的特定项目。

In the absence of other suggestions, I am going to simply encrypt the secondary credentials using the user's password. This isn't ideal (as I will lose the data when they update it), but should be sufficient for my particular project at the moment.

这篇关于将用户凭据安全地存储在DB中，用于PHP Web应用程序的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！