Re: Ilogin Authentication problem

Hello Florencia,

The mailling list [email protected] was created to create an 
information exchange between all 4GL and BDL users.
And not to get support information from Four J's.

Therefore if you want an issue number, may you can contact your
support center, please.

Thank you very much,

Olivier ECKERT - Four J's Development Tools

European Support Manager


Florencia Vitale a écrit :
> Hi again,
> 
> Well, despite of having no answer from FourJ's to this issue, I'll give you my feedback.
> 
> The real problem was not that the user could login to the Linux server with the wrong user, but that the terminal window header had the user wrong. So the bug is there. If you change the username at the first attempt to log in, the window header is changed, but if you give a wrong password to the original user, and then change the username, the first username is still shown in the window header, and that confused the users.
> 
> So now, as a workarround, I changed the terminal window title, so that it doesn't show the username at all.
> 
> Can I have a bug number for this ?
> 
> Thanks,
> 
> Florencia
> 
> 
>>-----Mensaje original-----
>>De: [email protected] [mailto:[email protected]]En
>>nombre de Florencia Vitale
>>Enviado el: Viernes, 11 de Noviembre de 2005 17:36
>>Para: [email protected]
>>Asunto: RE: [fourjs-users] Ilogin Authentication problem
>>
>>
>>Hi Nuno,
>>
>>Thanks for your answer. But, it's not clear to me if you could 
>>reproduce it. If you could, on which server platform ? Or you are 
>>guessing this could happen according to what you've tested ?
>>
>>But it still doesn't make sense that user "A" logs in as user 
>>"B", but user "A" never typed that password in any combination of 
>>errors, because he doesn't know it. So, I guess, login and 
>>password prompts could be mangled, but the login should never 
>>succeed. According to our customer, this happens with every pair 
>>of user/password you choose and on any PC already configured. So 
>>it's not a case of coincidence in the passwords or usernames with 
>>passwords.
>>
>>Nevertheless, I've already asked my customer to send me it's 
>>login prompts, and WFE configuration, in order to check this out.
>>
>>Thanks again, any further comments please let me know, as I'm 
>>still struggling with this, and it's a big security issue for our 
>>customer.
>>
>>Luckily, we never use WFE's ilogin, instead we use telnet and 
>>macros in the emulator, as we've already had some security issues 
>>long time ago. But this customer insisted they wanted the nice 
>>"windows like" login, and we made some testes, and nothing went 
>>wrong, so we though those issues were solved. Until now.
>>
>>Thanks,
>>
>>Florencia
>>
>>
>>>-----Mensaje original-----
>>>De: [email protected] [mailto:[email protected]]En
>>>nombre de Nuno Godinho
>>>Enviado el: Viernes, 11 de Noviembre de 2005 14:54
>>>Para: [email protected]
>>>Asunto: RE: [fourjs-users] Ilogin Authentication problem
>>>
>>>
>>>Hi!
>>>
>>>	Most probably, after the first try, the login screen stops 
>>>on the "password:" request. On the second try the login colects 
>>>the user name as the passord and therefore fails to succed. On 
>>>the subsequent tries I guess wtk fails to recognize the 
>>>LOGIN_QUESTION and/or PASSWORD_QUESTION as defined on 
>>>wtkserv.ini,  most probably because they have already been 
>>>presented and detected. I now it's a long shot, but I tried to 
>>>reproduce your situation in here and that's what I got.
>>>HIH
>>>Best
>>>Nuno
>>>
>>>-----Mensagem original-----
>>>De: Florencia Vitale [mailto:[email protected]]
>>>Enviada: sexta-feira, 11 de Novembro de 2005 17:29
>>>Para: FourJs BDS Users
>>>Assunto: [fourjs-users] Ilogin Authentication problem
>>>
>>>
>>>Hi,
>>>
>>>On a customer we are having a very strange problem :
>>>
>>>- the user A tries to log on to the system with wtk ilogin
>>>- he tries with the default user "B", that is defined on the 
>>>shortcut of a certain PC. As he doesn't "watch" the username, he 
>>>puts his own password, and it is refused.
>>>- then he tries again, with same user and password, and is refused again
>>>- then he realizes that the username is wrong, he changes to user 
>>>"A" and puts his own password (user's "A" password) and he logs in
>>>- but the odd thing is that he logs in as user "B", not as user "A"
>>>
>>>This happens with this products :
>>>
>>>- Linux Server RH Enterprise 3.0
>>>- fglrun -> 3.54.02.20
>>>- Wfe (wtk) -> 3.53.1a
>>>
>>>I've tried to reproduce this problem here, against a Sun server 
>>>(solaris 5.8), and against a Red Hat 8.0 server, and I couldn't 
>>>reproduce it. I've tried with almost the same BDS version 
>>>(3.54.01.19) and the exact same WFE version.
>>>
>>>But maybe it's a problem of RHEAS ? Or is it a known bug ? Or is 
>>>something we can configure ?
>>>
>>>I've also checked our customer's /etc/hosts.equiv and 
>>>"$HOME/.rhosts" files, and they don't have any of those configured.
>>>
>>>Thanks in advance,
>>>
>>>Florencia
>>>
>>>
>>>-- 
>>>No virus found in this incoming message.
>>>Checked by AVG Free Edition.
>>>Version: 7.1.362 / Virus Database: 267.13.0/167 - Release Date: 
>>
>>11/11/2005
>>
>>>
>>
>>-- 
>>No virus found in this incoming message.
>>Checked by AVG Free Edition.
>>Version: 7.1.362 / Virus Database: 267.13.0/167 - Release Date: 11/11/2005
>>
>>
> 
>