Re: Prompting for iseries user ID and password on a web application

Because when you have forced password changes and software that caches
a password, you end up getting your profile disabled multiple times
before everything has the new password? :)

I hate changing my password! Between WDSCi, my blackberry, ect. ect.I
end up wasting a day reenabling my user ID multiple times after
changing my password....

It'd be nice if you could configure a grace period of some sort, ie.
for the first 4hrs after changing a password invalid attempts don't
count. Better yet, if the password sent is the old one, send back an
invalid response but don't count it as an attempt.

And yes, I'm sure single sign on would help...but...

Charles



On Tue, Jun 15, 2010 at 2:29 PM, CRPence <CRPbottle@xxxxxxxxx> wrote:

On 14-Jun-2010 07:31, Thorbjørn Ravn Andersen wrote:

<<SNIP>>

Is there ANY way to validate an AS400 login which does not count
in the way  down to disabling the account?

<<SNIP>>

  Why would that be valuable?  The whole point in failures leading
to disabling, is to protect the system.  Would not eliminating the
effect, just open the system to attack.?

  A similar effect could be achieved by use of the request to
CHGSYSVAL QMAXSIGN *NOMAX; albeit highly discouraged, for the same
reason alluded in the above questions.  In so doing, although the
number of failures is tracked, no amount of invalid requests would
ever have the account\*USRPRF becoming disabled due to the failed
attempts to validate.  There is no equivalent MAXSIGN() parameter
associated with each *USRPRF object to effect any granularity :-(
nor to members of a group\*GRPPRF.

Regards, Chuck
--
This is the Java Programming on and around the iSeries / AS400 (JAVA400-L) mailing list
To post a message email: JAVA400-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/java400-l
or email: JAVA400-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/java400-l.