Authentication Dialog Type

Overview

When DAF detects that access to a resource requires authentication of the user, the application will ask the client to enter a Login and a Password. This can be done through the standard popup authentication dialog box or with an HTML login form. If the HTML login form is used, the user login and password MUST be stored in cookies. Therefore, this setting will not work if the client has disabled the use of cookies for his browser.

• Standard Popup Authentication dialog box:

• User Authentication with an HTML login form (can be customized):

Settings related to authentication dialog type are available under tab "Cookies & HTML Form"

Tab "Cookies & HTML Form"

Before you start the configuration Cookies & HTML Form, it is important to be sure that your DAF installation is working properly with the usual popup authentication window.

Configuration to use Cookies with the standard authentication popup window:

It is possible to use cookies with the standard login popup window. With this setting the client will freely access the protected area until the cookie expires.

To accept incoming cookies as a login and password, option "Read login and password in Cookies" must be ENBALED. To automatically save the current login and password in cookies, option "Send cookie on successful standard logon" should be enabled. If this option is DISABLED cookies must be set manually, for example with an ASP script.

With the following settings, the login and password entered by the Web user will saved in cookies. The client will freely access the protected area until the cookie expires:

• Launch the DAF Configuration Tool (Release 4.0 beta 4 or later)
• Select a database
• Select Tab "Cookies & HTML form"
• Check "Read login and password in Cookies"
• Check "Send cookie on successful standard logon"
• Choose a Cookies Expire option and set a delay if needed
• Enter a password (this password will be used to encrypt the password before setting the cookie)

If you wish the cookies to be set only ONCE per session (after a successful logon) it is necessary to enable the concurrent access control for DAF User. Without this setting a web client who has disabled cookies on his browser will receive cookies notification for each HTTP request sent. With this option enabled, he will receive notifications only once after a successful logon.

• Select Tab "Concurrent Access Control"
• Check "Enable Concurrent Access Control"
• Check "For DAF User"
• If needed, enable other options.

Configuration to use Cookies with an HTML Login form:

Option HTML Login form will work only with browsers allowing cookies.

• Launch the DAF Configuration Tool (Release 4.0 beta 4 or later)
• Select a database
• Select tab "Cookies & HTML form"
• Check "Read login and password in Cookies"
• Choose a Cookies Expire option and set a delay if needed
• Enter a password (this password will be used to encrypt the password before setting the cookie)
• Check "Use HTML Login Form"
• Uncheck "Use CUSTOM Login form"

Customize the HTML Login form

If needed, customize the HTML login form. For instructions, please click here.

Important note for specific HTTP client (e.g., FrontPage)

When an HTML login form is used the client will NOT receive the standard status code 401 (Access Denied). This can be a problem for specific HTTP clients who rely on this code to request the user to login. In other words, when the client receives the HTML login form, it will not "know" that the server is requesting an authentication. Therefore, it will not ask the user to login.

To solve this issue option "Except for User-Agent" was implemented. Before sending the HTML login form DAF will check that the received user agent information does not include a string specified in the "Except for User-Agent" field. If this is the case, a standard HTTP status 401 will be returned.

If several strings are specified in the "Except for User-Agent" option, they must be delimited with a comma. The string comparison is case sensitive.

To find what User Agent string is sent by a client:

• Launch the DAF Configuration Tool
• Select any DAF User Database
• Select tab "Logs"
• Check "Log all HTTP requests"
• Press "Live Log"
• Select "Main log"
• Use  the specific client
• Check what is reported in the Live Log window

For example, with FrontPage Explorer, the following is reported:

HTTP Request for <192.168.200.1>,<80>,<www.daf.com> from <192.168.200.110>,<Mozilla/2.0 (compatible; MS FrontPage 3.0)> - Attached to <SQLServer>

and with FrontPage Editor, the following is reported:

HTTP Request for <192.168.200.1>,<80>,<www.daf.com> from <192.168.200.110>,<MSFrontPage/3.0> - Attached to <SQLServer>

Since the string "FrontPage" is present in both cases, if it is specified in the "Except for User-Agent" field the site will work with FrontPage.

Last update: Friday, April 02, 1999 08:18