question Error message when login fails in ITSM forum

Error message when login fails

Patrick Schulte — Sun, 04 May 2014 18:08:20 GMT

Hello everyone,

we are using the predefined "Login" dynamic content block and modyfied the layout to meet our needs.
Everything works out fine but I would like to know which script service now is using to verify the users credentials.
Usecase: For better usability I would like to split up the current error message if either the username is wrong and/or the password.
Current message: User name or password invalid.

That's not really specific....

I found the "PortletLogin" in Script Includes but that doesn't seem to be the right one. Any ideas?

Best regards,

Patrick

Re: Error message when login fails

marcia_jones — Wed, 11 Jun 2014 18:58:53 GMT

Hi Patrick,

I would recommend that you leave the message as it. As an IS Auditor, from a security perspective, generic is better. You do NOT want to tell a hacker which part of the login process they have right or wrong.

My two cents.

Marcia,

CISA

Re: Error message when login fails

Jim Coyne — Wed, 11 Jun 2014 19:02:17 GMT

Agree 100%. I understand wanting to help the users out as much as possible, but that would not be a good idea in this particular case.

Re: Error message when login fails

Patrick Schulte — Thu, 12 Jun 2014 06:22:39 GMT

We discussed this internally and came to the same conclusion .
Anyways, thanks gusys for the valuable input.

Re: Error message when login fails

Miguel Sanchez — Thu, 27 Nov 2014 11:58:34 GMT

Hi Marcia,

I have a similar need: I need to set a custom error message only when the error is related with a LDAP problem, to inform the user that he/she needs to change its password in Windows before to attempt to log-in again.

I've been trying to find where is the code which handles it, but I haven't found it... Any clue?

Many thanks!

Re: Error message when login fails

yvan — Fri, 29 Apr 2016 19:04:35 GMT

But lets say you wanted edit it anyway, where would you do that? To advise the use that their account is locked now due to too many failed login attempts, for example.

Re: Error message when login fails

vampyre82nd — Thu, 02 Feb 2017 21:04:57 GMT

Yvan,

The answer to your Question is

Specify lockout for failed login attempts

SNC User Lockout Check: Tracks the number of failed login attempts and locks the user account after a specified number of failed login attempts (default: 5).

// Check to see if the user has failed to login too many times

// when the limit is reached, lock the user out of the system

var gr = new GlideRecord("sys_user");

gr.addQuery("user_name", event.parm1.toString());

gr.query();

if (gr.next()) {

gr.failed_attempts += 1;

if (gr.failed_attempts > 2) {

gr.locked_out = true;

gr.update();

gs.log("User " + event.parm1 + " locked out due to too many invalid login attempts");

} else {

gr.update();

}

Re: Error message when login fails

Arun101 — Thu, 23 Jan 2020 06:26:39 GMT

I still haven't found the answer though. I have so many script includes.

For eg. I have "BasicAuth" script include and trying to call it using URL(view_form.login). Basically how an angular post menthod from client script is connected to script include or how a client script is calling script include. Can anyone answer please?