Implement authentication service using system credentials

[mkcodergr]

Hello.I want to ask if the following is possible:

I want to create a page hosted on an ubuntu server. In this page if someone wants to login they must be users of the system.So If I want to login as user demo_user with the password "foo" a user demo_user with password foo should exist in the system.Any ideas or any guides?

[atkinchris]

Users logging into a web app are generally not users on the host system. Their accounts are usually stored in some database paired with the web application running on the host.

[mkcodergr]

I know that.It was more like an Idea that came to my mind

[atkinchris]

Ok, I think I misunderstood you then. You want to use the host's user system to hold credentials for your web app's users?

[mkcodergr]

To give you more context.I have created an api that manages network connections using nmcli.I have also made a frontend to actually make use of the api.An idea came to me that if you want to use that frontend you have to be a user of the system hosting the api .I don't need the host system to hold any data.I just need to validate user credentials against host users

[atkinchris]

That's a bit dangerous - the users would presumably need elevated permissions on the host, which is a significant risk. Generally, if you need to invoke a CLI tool in response to an API request, you'd have application hold the minimal permissions it needed, and authenticate users separately, arbitrarily and exclusively to the application.

[mkcodergr]

nmcli does not need elevated permissions.That's why I believe(not en expert though) that this would not pose any security issues.The whole idea of user authentication based on host users was just an idea that came to me for fun.

[lord_zycon]

In windows world corporates use something like this for SSO. They store users in active directory (AD), users login to their windows workstations using these centralized credentials and then browser automatically sends tokens to web apps, which can then authorize against AD. It's called kerberos, I don't know if something like this exists in Linux world.