Tweet
Security Experts, We moved several applications from green screen to browser. That was about 91 days ago. We found that users that don't actually sign-on do not get their last sign on date updated. They do get their profiles swapped by at least one exit program. It appears as though the Change Previous Sign-on Date API will allow us to keep up their last sign-on date. Now the tough part. We also expire passwords at 90 day intervals. I can think of several alternatives that would allow us to recognize that the password will expire and prompt for a new password. Those options would require some programming in either Java or stored procedures. It seems like IBM would supply a built-in function for this. Many of these users do not have Client Access installed, but the base version may be an option. Any ideas? Thanks, David Morris
-
-
Expiring profiles
"It seems like IBM would supply a built-in function for this" David - This is an excerpt from an e-mail I received from Carol Woodbury regarding this exact issue - "I believe your concern was that when you required basic authentication for a particular web page and the user's password was expired that there would be no way for the user to sign on and change their password. Currently, there is no support for this function within the web server. We have heard the requirement before, but currently have no implementation plans. However, you should be able to accomplish this function by using the error customization function of the web server and the QSYCHGPW - Change user profile API." We did exactly as Carol suggested and it works very well. HTH, Steve -
Expiring profiles
steve, i attempted this exact solution, but could not get the errorpage directive in the HTTP server to give me a custom page on a pwexpired error. any chance you could give me some hints. thank you very much. -mikeComment
-
Expiring profiles
Mike - Do you have an ErrorPage directive in your HTTP config? Our looks like this: ErrorPage pwexpired Http://sysname/QSYS.LIB/CGI.LIB/QHTM...ILE/CHGPWD.MBR where 'sysname' is your system name. CHGPWD.MBR is just HTML loaded into a source member that ultimately calls an RPGLE program which passes user-id, current password, and new password to the QSYCHGPW API. HTH, SteveComment
-
Expiring profiles
hi steve, thanks for your quick response. yes i do. i have that and other errors "trapped" using the ErrorPage directive, and the other ones work, just not the pwdexpired one. we are on V4R4, and are not using the Apache version. what version are you on? my error page is not fully qualified like yours is, maybe i need to try that (i.e. htt://sysname . . .) sort of related to this. i do not get my custom error message to show up under IE 5.5 unless i turn "show friendly error messages" off. have you had this problem? or are you using netscape? thanks, mikeComment
-
Expiring profiles
Mike - I notice that you typed 'pwdexpired', not 'pwexpired'. 'pwexpired' is the correct directive - did you verify this spelling in your HTTP config? We are on V4R4 using the standard 400 webserver also. Actually, our error page is not fully qualified either, I just posted that way for simplicity. I don't know that we have anyone using IE 5.5 but I'm sure that someone would've yelled if there was a problem. Personally, I use IE 5.0 with no problem. HTH, SteveComment
-
Expiring profiles
hi steve, it is pwexpired, i had a typo. if you got it to work then it must be possible, i just need to experiment with my HTTP config a little more. i wrote some programs that use the APIs to determine if a password is going to expire, which pops up a change password screen, and it all works great. i just want to pop up that same page when a password is already expired which is why i need this directive to work. i did run accross something interesting about IE 5.x. there is something in the windows registry which tells the browser to ignore a custom error page if it is less than xxx bytes (usually 512). when doing my testing, my error page was one sentence for testing purposes. i think IE just ignored it. MS claims that anything less than 512 bytes can't be any "friendlier" than their error page. thanks for your help steve. -mikeComment
Comment