enhanced security and new password

Classic Servoy
1

I want to force the user to create a new password on first login.

I have a login module and an authentication module (very much like how it is documented on the wiki).

What would be the best approach to do this in a web client (no NG yet).

The way I see this:

  • login form shows
  • user logs in with provided username/password
  • check for first time login
  • show new window, dialog or hide current fields and show new fields?

Thanks,
Marcel

2

As you probably know, Servoy doesn’t let you switch forms on the login solution. However, you can use tabpanels. So I tend to build my login forms with a tabpanel. 1st tab is login, 2nd tab is forgot password, 3rd tab is password reset. Then I switch the tabs in the tabpanel to show the one I want. Seems to give the most flexibility.

3

Thank you Scott, that was what I was thinking as well.

Your remark about not being allowed to switch forms was basically the background of my question :)

4

Scott,

Servoy lets you switch to any form in the login-solution.
You cannot switch to a form that is in your main solution (or in a module) until the user is logged in.

The only difference is that in the login-solution you do not have directly access to the database (only via calls to an authenticator solution).

Rob

5

Hi Rob,

So how do you suggest to deal with what I want?

6

You will have to use the authenticator solution for that. So you have to call the authenticator with the new password. Something like this:

security.authenticate("authenticateSolution", "scopes.authenticate.changePassword", [oldPassword, newPassword]);

That scopes.authenticate.changePassword can then return something that lets the login solution know whether that was successful etc.

7

Aha, so I can use the Authenticate solution/module for anything related to the database.

Thanks, that helps :)

8

Let’s put it this way: before a user is logged in, you have no access to the database. The authenticator runs on the server as a headless client and can do anything. You just have to ping-pong with it like you would do with a webservice maybe.

9

Exactly,

It is documented in the wiki: https://wiki.servoy.com/display/public/ … g+Security

Rob