# security.login returns false

**URL:** <https://forum.servoy.com/t/security-login-returns-false/15821>\
**Category:** Classic Servoy\
**Created:** [April 16, 2012, 7:39pm UTC](https://forum.servoy.com/t/security-login-returns-false/15821 "2012-04-16T19:39:29Z")\
**Posts on this page:** 17\
**Page:** 1

<div class="post-metadata">

**Author:** ![djlapin](https://avatars.discourse-cdn.com/v4/letter/d/4af34b/32.png) [@djlapin](https://forum.servoy.com/u/djlapin)\
**Post date:** [April 16, 2012, 7:39pm UTC](https://forum.servoy.com/t/security-login-returns-false/15821/1 "2012-04-16T19:39:29Z")

</div>

Why isn’t this working in the authenticator solution? I’ve also tried just passing [‘group’] as the third argument.

```auto
hashCode = plugins.it2be_cryptor.SHA(password + fsUserInfo['usr_password_salt']);
if(hashCode == fsUserInfo['usr_password_hash']) {
	var aAccessLevel = new Array(1);
	aAccessLevel[0] = fsUserInfo['usr_privilege_level'];
	proceed_B = security.login(fsUserInfo['usr_user_name'],fsUserInfo['usr_user_info_id'],aAccessLevel);
		if(proceed_B == true) { ...

```

thanks,  
Don

---

<div class="post-metadata">

**Author:** ![IT2Be](https://avatars.discourse-cdn.com/v4/letter/i/dc4da7/32.png) [@IT2Be](https://forum.servoy.com/u/IT2Be)\
**Post date:** [April 16, 2012, 8:16pm UTC](https://forum.servoy.com/t/security-login-returns-false/15821/2 "2012-04-16T20:16:32Z")

</div>

Why don’t you use SHAequals(…)

---

<div class="post-metadata">

**Author:** ![djlapin](https://avatars.discourse-cdn.com/v4/letter/d/4af34b/32.png) [@djlapin](https://forum.servoy.com/u/djlapin)\
**Post date:** [April 16, 2012, 11:14pm UTC](https://forum.servoy.com/t/security-login-returns-false/15821/3 "2012-04-16T23:14:19Z")

</div>

Hi Marcel,

That part works just fine. It’s the security.login which is returning false. Any theories on that?

Thank you,  
Don

---

<div class="post-metadata">

**Author:** ![IT2Be](https://avatars.discourse-cdn.com/v4/letter/i/dc4da7/32.png) [@IT2Be](https://forum.servoy.com/u/IT2Be)\
**Post date:** [April 17, 2012, 6:18am UTC](https://forum.servoy.com/t/security-login-returns-false/15821/4 "2012-04-17T06:18:34Z")

</div>

Are you sure the user name is correct?  
What happens when you use the below code?  
And, what happens when you use a hard coded user name?

```auto
proceed_B = security.login(fsUserInfo['usr_user_name']);
      if(proceed_B) { ...

```

---

<div class="post-metadata">

**Author:** ![djlapin](https://avatars.discourse-cdn.com/v4/letter/d/4af34b/32.png) [@djlapin](https://forum.servoy.com/u/djlapin)\
**Post date:** [April 17, 2012, 6:45am UTC](https://forum.servoy.com/t/security-login-returns-false/15821/5 "2012-04-17T06:45:52Z")

</div>

Hi Marcel,

When I try either of those other ways, I get error messages (see attached).

When you say, “are you sure that the name is correct”, what do you mean? This is using database table authentication, so (I assume that) the security.login() call doesn’t know any user names yet – I’m letting the system know who is logging in.

Thank you,  
Don

 ![JustName.png](https://canada1.discourse-cdn.com/flex010/uploads/servoy/original/2X/0/00398e1f83dcb5f21271f4bd60f0bb7aa62c3a00.png)

 ![JustHardCodeName.png](https://canada1.discourse-cdn.com/flex010/uploads/servoy/original/1X/9ae2b6d9f3f027e0dafcb42945abf323f28f82d2.png)

---

<div class="post-metadata">

**Author:** ![patrick](https://avatars.discourse-cdn.com/v4/letter/p/b2d939/32.png) [@patrick](https://forum.servoy.com/u/patrick)\
**Post date:** [April 17, 2012, 7:38am UTC](https://forum.servoy.com/t/security-login-returns-false/15821/6 "2012-04-17T07:38:08Z")

</div>

Look at the login method. It wants a user name, user id and a groups array.

---

<div class="post-metadata">

**Author:** ![djlapin](https://avatars.discourse-cdn.com/v4/letter/d/4af34b/32.png) [@djlapin](https://forum.servoy.com/u/djlapin)\
**Post date:** [April 17, 2012, 7:42am UTC](https://forum.servoy.com/t/security-login-returns-false/15821/7 "2012-04-17T07:42:58Z")

</div>

Hi Patrick,

Those were the arguments being passed to security.login(), before the two tests above. It’s the line that is commented out. When I trace, I see the values. Is that what you mean?

Thank you,  
Don

---

<div class="post-metadata">

**Author:** ![IT2Be](https://avatars.discourse-cdn.com/v4/letter/i/dc4da7/32.png) [@IT2Be](https://forum.servoy.com/u/IT2Be)\
**Post date:** [April 17, 2012, 7:50am UTC](https://forum.servoy.com/t/security-login-returns-false/15821/8 "2012-04-17T07:50:04Z")

</div>

OK, the login(name) thing is my mistake.  
Maybe you should use only hardcoded values at first (like you did in the 2nd sample) to see if that works.

---

<div class="post-metadata">

**Author:** ![djlapin](https://avatars.discourse-cdn.com/v4/letter/d/4af34b/32.png) [@djlapin](https://forum.servoy.com/u/djlapin)\
**Post date:** [April 17, 2012, 8:11am UTC](https://forum.servoy.com/t/security-login-returns-false/15821/9 "2012-04-17T08:11:32Z")

</div>

Hi Marcel,

It still returns false (see attached). Any more thoughts on things to try? Perhaps there is something really obvious I’ve overlooked? I notice that the warning message says something about needing an object rather than a string argument.

Thank you,  
Don

 ![HardCodeAllThree.png](https://canada1.discourse-cdn.com/flex010/uploads/servoy/original/2X/b/b97db453c51c80a290ee0c9ac4532f9ac0abbe93.png)

---

<div class="post-metadata">

**Author:** ![IT2Be](https://avatars.discourse-cdn.com/v4/letter/i/dc4da7/32.png) [@IT2Be](https://forum.servoy.com/u/IT2Be)\
**Post date:** [April 17, 2012, 8:22am UTC](https://forum.servoy.com/t/security-login-returns-false/15821/10 "2012-04-17T08:22:49Z")

</div>

When ‘Designer’ is the display name and the uuid and groups are correct I don’t see why this would fail.

I did notice though that the tooltip says that the uuid must be an Object.  
A String value is an Object as well so I guess this only means that you can use different data types.

---

<div class="post-metadata">

**Author:** ![djlapin](https://avatars.discourse-cdn.com/v4/letter/d/4af34b/32.png) [@djlapin](https://forum.servoy.com/u/djlapin)\
**Post date:** [April 17, 2012, 8:40am UTC](https://forum.servoy.com/t/security-login-returns-false/15821/11 "2012-04-17T08:40:59Z")

</div>

Hi Marcel,

What do you mean by “correct” – is the command checking against some other reference before it returns true? What would cause this command to return false instead of true?

Thank you,  
Don

---

<div class="post-metadata">

**Author:** ![IT2Be](https://avatars.discourse-cdn.com/v4/letter/i/dc4da7/32.png) [@IT2Be](https://forum.servoy.com/u/IT2Be)\
**Post date:** [April 17, 2012, 9:01am UTC](https://forum.servoy.com/t/security-login-returns-false/15821/12 "2012-04-17T09:01:33Z")

</div>

Reading the wiki ([http://wiki.servoy.com/display/public/D … 50467C42ED](http://wiki.servoy.com/display/public/DOCS/Implementing+Security;jsessionid=375CDD8AACE46C4ECA45FF50467C42ED)) I would say that the user, uuid and groups have to exist within Servoy.  
To be honest, I have not used this method yet so I am not sure…

---

<div class="post-metadata">

**Author:** ![djlapin](https://avatars.discourse-cdn.com/v4/letter/d/4af34b/32.png) [@djlapin](https://forum.servoy.com/u/djlapin)\
**Post date:** [April 17, 2012, 9:12am UTC](https://forum.servoy.com/t/security-login-returns-false/15821/13 "2012-04-17T09:12:34Z")

</div>

Hi Marcel,

I’m getting a “server not found” for the Servoy Wiki right now. I have read the discussion of custom login solutions a few times now, and I think that I remember most of it. I also (loosely) based my login solution code on the servoy\_security solution.

I thought that the purpose of the security.login command in the authentication method was for Servoy to move the user from the login page to the first form of the solution itself. The developer is responsible for any validation of the user name and password, prior to calling security.login(). So what additional validation would this command perform?

Is anyone else using security.login() with a custom authentication method?

Thank you,  
Don

---

<div class="post-metadata">

**Author:** ![IT2Be](https://avatars.discourse-cdn.com/v4/letter/i/dc4da7/32.png) [@IT2Be](https://forum.servoy.com/u/IT2Be)\
**Post date:** [April 17, 2012, 9:22am UTC](https://forum.servoy.com/t/security-login-returns-false/15821/14 "2012-04-17T09:22:32Z")

</div>

I only have a test user on my server and that fails as well with the authentication and login to be honest…  
That is why I (also) think that the user has to be know in Servoy (like in older security setup).

---

<div class="post-metadata">

**Author:** ![djlapin](https://avatars.discourse-cdn.com/v4/letter/d/4af34b/32.png) [@djlapin](https://forum.servoy.com/u/djlapin)\
**Post date:** [April 17, 2012, 8:49pm UTC](https://forum.servoy.com/t/security-login-returns-false/15821/15 "2012-04-17T20:49:54Z")

</div>

Hi Marcel,

I also tried the following, thinking that maybe Servoy needs to have the user listed in its own internal db,

```auto
var returnUID = security.createUser(fsUserInfo['usr_user_name'],fsUserInfo['usr_password_hash'],fsUserInfo['usr_user_info_id'])
proceed_B = security.login(fsUserInfo['usr_user_name'], fsUserInfo['usr_user_info_id'], ['']);

```

However, it still returns proceed\_B as false.

Is there anyone out there that is using custom authentication?

Thank you,  
Don

---

<div class="post-metadata">

**Author:** ![rgansevles](https://avatars.discourse-cdn.com/v4/letter/r/3d9bf3/32.png) [@rgansevles](https://forum.servoy.com/u/rgansevles)\
**Post date:** [June 14, 2012, 6:42am UTC](https://forum.servoy.com/t/security-login-returns-false/15821/16 "2012-06-14T06:42:30Z")

</div>

Don,

security.login requires a non-null, non-empty array of strings as group names, all these groups have to exist.  
Your code uses group Administrator, does this group exist?  
Maybe it is a typo, Servoy comes with a standard group called Administrators.

When security.login fails because of unknown group, you should see a message in the log file like:  
Could not log in user for unknown group ‘Administrator’"

Rob

---

<div class="post-metadata">

**Author:** ![djlapin](https://avatars.discourse-cdn.com/v4/letter/d/4af34b/32.png) [@djlapin](https://forum.servoy.com/u/djlapin)\
**Post date:** [June 14, 2012, 9:07pm UTC](https://forum.servoy.com/t/security-login-returns-false/15821/17 "2012-06-14T21:07:11Z")

</div>

Hi Rob,

That solved the problem. Because I’m doing custom security, I didn’t realize that I still needed to create the users and groups in the structure of the program (“User/Group Editor”). I thought that I would manage this completely on my own with the data tables, and that Servoy would simply pass back the user UID I would give it, to the onSolutionOpen method in the main application.

Thanks very much, this issue had been a hindrance for some time.

Don