Home » forums » Luminis Platform / System

After hotfix 125 login hiccups?

Submitted by yeah on Wed, 2010-02-24 20:03

We havea  custom login page that uses a javscript call Luminis to first see if the systems is going to log  the user in with the entered username/password combination.

All it does is fatch the html and see if there is the string "Failed Login" in the html.  If so, we just show them a "bad password" like message.

However, with the recent patch to 4.2.1.125, this doesn't work 100% of the time. About 10% of the time, the javascript is presented an empty string.  This isn't that big a deal, the javascript doesn't see the string its looking for and just sends the user on to Luminis.  If the password is wrong, Luminis's default message is displayed.

My question is are others seeing it where nothing shows up when  user logs in? I haven't tested the default login to see.  

I think I'm just going to move on, its not detrimental, but the inconsistency is annoying.  If any of you are seeing this and have a solution or would like to work on a solution together, let me know.

‹ iFrame loading errors Google Analytics and Activetab issue ›

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.

why would you do that

Submitted by libdms on Thu, 2010-02-25 06:39.

I ask because you could always customise the "cannot find username/password pair" page instead.

We are putting together a modification for our login page, that checks whether the username is is AD first. If it is, then we want to disable the Luminis copy of the previous AD password. That way, when we hit the Fall Through auth chain we do not get undesired behaviour.

Our chain goes like this

1) Check against AD

2) Check against LP ldap

3) username/password pair error

I actually consider the way Luminis takes the current password used to log in and stores it in the LDAP in the same field that is then used for Step 2) a real security error and poor implementation choice. The purpose that the current password is stored is so that GCF can use it and the secret store can be unlocked. Where only Step 2) exists in the chain you can get away with it, but as soon as Step 1) is introduced it is easy to demonstrate problems.

Derek
University of Leeds, UK

many reasons

Submitted by yeah on Thu, 2010-02-25 17:13.

Really this was just a simple way to do it. Quick javascript reading was all that was necessary.

Was anyone else's login's affected by the hotfix 125 upgrade?

Syndicate content