Secure Login Scripting. Informational--DRAFT. prepared for. Novell. April 2004

Transcription

1 Secure Login Scripting Informational--DRAFT Novell prepared for April 2004

2

3 Disclaimer Novell, Inc. makes no representations or warranties with respect to the contents or use of this document, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. Trademarks Novell is a registered trademark of Novell, Inc. in the United States and other countries. * All third-party trademarks are property of their respective owner. Copyright 2004 Novell, Inc. All rights reserved. No part of this publication may be reproduced, photocopied, stored on a retrieval system, or transmitted without the express written consent of Novell, Inc. Novell, Inc South Novell Place Provo, UT USA Novell UK Limited Novell House 1 Arlington Square Downshire Way Bracknell Berkshire RG12 1WA Prepared By David Guest Secure Login Scripting Informational April 2004 Statement of Work: Novell Number: Consultants: David Guest

4 Revision History Version Date Owner Revisions Reviewer Record Version Date Reviewers Name Reviewers Role (Peer/ Team Leader / Project Manager) Final Approval Version Date Approver

5 NovellNovell Contents Contents Executive Summary...1 Script Development...2 Building Blocks... 2 Script Header...2 Log In Dialog...3 Change Password Dialog... 4 Password Expiration...5 Log In Failure...5 Log in success (Mostly in Terminal Emulation)...6 Secure Login Scripting Informational i

6

7 NovellNovell Script Development Executive Summary This document will put forward a standard approach to scripting applications within the Novell Secure Login (NSL) environment. It will explain the sections that must be included within the scripts for Windows, Web and Terminal Emulation applications. This document will not describe the scripting process, the commands used within scripting or attempt to present a training environment for support staff who wish to learn how to script and support the existing scripts. Secure Login Scripting Informational 1

8 Script Development Script Development Each NSL script should be made up of a series of building blocks. These should be easily identifiable and should, where possible, have additional comments built in to the script to simplify the support of the scripts. Building Blocks Each script will contain a number of sections. These can be seen as building blocks which, when combined, produce a valid and complete script. A list of building blocks that could be contained in a script are: Script Header Log In Dialog Change Password Dialog Password Expiration Log In Failure Log in success (Mostly in Terminal Emulation) Application Detection Other Message Detection Each of these will be discussed individually with sample script excerpts later in this document. Script Header At the start of each script a standard header should be used. This will include details on the application being scripted, modification dates and the modifications made. A standard header would look as follows: 2 Novell / Novell Confidential

9 NovellNovell Script Development Log In Dialog Secure Login Script Application : Application Description : Initial Script created on : by : Modification Log Modified By - Date (yyyymmdd) - Description eg David Guest Initial Script Creation This should be inserted, using cut and paste, at the start of each script. The heart of the Single Sign On process is the auto-completion of the Log In dialog. NSL works by detecting the authentication request, window, of the application and responds specifically to each window. The following screen shot shows a typical authentication dialog Here we can see that a Username, Password and an other field are required. NSL detects this screen and responds appropriately. The script excerpt that handles this is as follows. Secure Login Scripting Informational 3

10 Script Development Dialog Class "32770" Title "Log in" EndDialog Setprompt "Username:" Type $Username 1001 Setprompt "Password:" Type $Password 1002 Setprompt "Optional:" Type $Optional 1003 Click 1 Here the class and title of the window are specified with the correct details being entered into each field. Change Password Dialog Obviously any change to the user password within an application must be managed. This is accomplished by monitoring the application to detect the display of the change password dialog. A sample change password dialog could be: Here the application is asking for the old password to be inserted before the new password is entered and confirmed. In order to manage occasions where the password change fails; possibly because a password is not complex enough or it has been used before; it is important for NSL to keep the old password stored until such time as the password change is confirmed. This dialogue is managed by the following script excerpt: 4 Novell / Novell Confidential

11 NovellNovell Script Development Dialog Class "32770" Title "Change Password" EndDialog Setprompt "Username:" Type "$Username" 1015 Setprompt "Password:" Type "$password" 1004 ChangePassword?newpassword Type?newpassword 1005 Type?newpassword 1006 Click 1 If?changePasswordDelayCommit(PasswordTest.exe) eq 0 Set $password?newpassword EndIf Password Expiration As passwords expire many applications prompt the user with details that show the password has expired. This may take the form of a single message box with both the expiry message and the fields for the updated passwords, or it may be two dialogue boxes the first advising of the password change requirement and the second allowing the user to change the password. The routing to change the password should be identical to the change password section above. Log In Failure When a user fails to access the application, either a bad ID or password, than NSL must recognise the failure and react accordingly. Some applications produce a separate dialog box with a message similar to Your Login Attempt has Failed. This must be intercepted by NSL and the user prompted to change the ID or Password. This may look like the following script excerpt. Dialog Class Title Logon Failure EndDialog DisplayVariables Your logon attempt has failed. Please confirm your Username and Password. $Username $Password Click 2 When the control passes back to the login screen the logon section should be repeated. It is always worth incrementing a counter to ensure that the user does not get stuck in a loop putting in whet they believe is the correct details when the application will not accept them. This can be done by adding the counter to the failure dialogue. Secure Login Scripting Informational 5

12 Script Development Dialog Class Title Logon Failure EndDialog Increment?FailCount If?FailCount lt 3 DisplayVariables Your logon attempt has failed. Please confirm your Username and Password. $Username $Password Click 2 Else MessageBox The Username and password are still incorrect. Please contact the help desk for more details. KillApp AppTester.exe EndScript EndIf This excerpt also closes down the application which is running after asking the user to contact the help desk. Log in success (Mostly in Terminal Emulation) In some cases, mostly where repeat/endrepeat loops are used, it is necessary to detect the success of a log in and break out of the script. Specifically terminal emulation scripts work in this manner. With Windows scripts the script runs repeatedly and activates only when a recognised dialog section appears. With Emulation this is not the case. Here the script starts at the top and runs to the end. With Generic and Advanced Generic emulators it is necessary to read the complete screen of information looking for specific text. This may cause the screen to flash as it is selected and copied. This text is searched through to match any text being searched for. This flashing can make the screen unusable for a user and generally means that the script must have finished before a user can use the system. In order to search multiple screens it is necessary to start a repeat section looking for specific text and then act on that text at each point. When the final User is logged on text appears the script should be ended. 6 Novell / Novell Confidential

13