Question
Nielsen
US
Last activity: 12 Oct 2016 16:06 EDT
Maximum Number of Failed Login Attempts
Hi - We need to show an error message on the Login Screen if the user tried to login with an invalid password more than 6 times.
Currently it displays a page which is a pega default page which gives an unathenticated error . Is there a way I can customize this page or use my own page ?
Thanks,
Smitha Rajasenan
***Updated by moderator: Marissa to update categories***
***Updated by Moderator: Marissa to add SR Details***
-
Like (0)
-
Share this page Facebook Twitter LinkedIn Email Copying... Copied!
Pegasystems Inc.
IN
Hi Smitha,
If you are looking to customize the login screen you can modfy web-login html stream. For unathenticated error you can change error div in web-login page.
You need to go for custom autentication if you want to limit number of login attempts. This can either be done by LDAP or SSO.
You can use below DSS to limit no of login attempts using custom authentication.
Ruleset:Pega-Engine
Purpose: Authentication/MaxLoginAttempts
Value: 6
Virtusa IT Consulting
AE
If you are using custom authentication then you can use 'pyChallenge' parameter with value as @java("PRAuthentication.DEFAULT_FAIL_STREAM") and provide HTML stream rule that you want to show on failure in 'Credential challenge stream' field in custom' tab of your authentication service rule.
You can use different values to handle the authentication challenges, I am attaching a file that includes different authentication parameters can be used to handle challenges.
Nielsen
US
Thank you for the reply.
I am getting an exception from Pega when I try this scenario.
I was getting an exception even when I made no changes to the number of login attempts. The param pyWasTimedOut does not have any value in the Authentication Activity . And the code succesfully completes the Auth Activity , but throws an exception in the web-login page.
I saved the AuthenticationTimeout (ID : AuthenticationLDAPTimeout ) into my ruleset . This activity is not being called as per the logs .
From the documentation, I assumed that this activity should be called if I set the Timeout options in the LDAP (webldap3) authentication service. Do I have to set some flag or anything specific so that the timeout activity is called with the param pyWasTimedOut correctly set ?
Thanks,
Smitha Rajasenan
Pegasystems Inc.
US
Does the access group UnAuthenticated have access to your ruleset?
Nielsen
US
Yes coz it can access the Authentication Activity under the same Ruleset . Also there are no exceptions thrown during authentication. It does not call the Authentication timeout activity.
There is an exception at the end of the flow which is when web-login.html is rendered.
Pegasystems Inc.
US
Please open an SR so we can get a closer look.
Pegasystems Inc.
US
... and add note here referencing the new SR, please.