Access permission for a PHP + AD + Oracle system

Question

Good morning,

I’m new to PHP and I’m starting a system for the company I work for, generating reports.

Currently my PHP code authenticates with an Active Directory normally, and when connecting, it goes to a page with several reports.

These reports make a temporary connection to an Oracle 10g Database and when finished displaying the code, close this connection.

However, my problem, is that all users have access to all reports, which is unviable, because it has reports that only the Board can access, while some reports only the Tax sector, and so on.

I looked for some solutions, but I couldn’t find anything I could apply to my environment.

I wonder if anyone can shed some light on my problem:

I want the permissions of each report to be per user or group, preferably I can give the permissions directly in AD.

It is possible?

Thank you

Answer 1

If you are authenticating an LDAP database, you can obviously query which group these users belong to. In PHP there is a function where you bring these groups, part of the idea where the group "Directorate" can see such reports and the group "operators" can see only these other reports. In practice in PHP, when making the query of which group the user belongs, you can make conditions using the Switch or even an IF. Examples:

Switch "$usuario->grupo"{
Case "Diretoria":
echo "Olá, estes são os relatórios diretoria"
break;
Case "Operador":
echo "Olá, estes são os relatórios operador"
break;
default:
echo "Olá, voce não faz parte de nenhum grupo, contate o administrador"
break;
}

Using IF

if($usuario->grupo == "Diretoria"){
    echo "Olá, estes são os relatórios diretoria"
}
elseif($usuario->grupo == "Operador"){
echo "Olá, estes são os relatórios operador"
}

Well, I’ve just cited a few examples, of course it goes from your programming logic. I hope I’ve helped.

Note: For LDAP queries using PHP, how to bring the group, from a read on http://php.net/manual/en/ref.ldap.php

Abs.