We have an application for use in medical offices, and with CCHIT certification becoming a requirement, are revisiting our own security. We have traditionally done our own login/password/access level authentication/authorization, but as long as we have to rewrite to meet standards, why not become more flexible.
While we are a Windows application, some of our clients do their authentication through UNIX, others use Novell, others use Windows Active Directory, others use nothing at all (small offices, small network).
I’d like to write against a single server (or write a single server) that we can use in ANY of the environments where we currently run, allowing the client to use what they have already created rather than maintaining two different logins, as they have to do with our product now.
Looking for suggestions for an application that can be made to provide the authentication work if it doesn’t already exist, but will work with the authentication tool in use, if it does exist.
Thanks.
And, if it matters, we work in Delphi, do not currently require .NET and also know Java.
The openly available Kerberos implementations provide Client Service Authorization as well as Client Authentication.
Read about Using Kerberos 5 on Red Hat Linux.
Windows Active Directory is also a Kerberos implementation.