<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<br class="">
<div>
<blockquote type="cite" class="">
<div class="">On Apr 28, 2015, at 2:45 PM, Ho, PeiQuan <<a href="mailto:PeiQuan.Ho@tufts.edu" class="">PeiQuan.Ho@tufts.edu</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">
I’m running some testing on the IDP with MCB. I noticed that when I’m directed to the IDP login page and I simply don’t login and just refresh the page, the MCB regards this as an SSO session and tries to query LDAP using a null user. This
fails of course. But it also increments the failed login count. The odd thing is in the logs, it shows that there was actually no previous session found, but the MCB still thinks it is SSO. Is this the place to be reporting possible MCB bugs?<o:p class=""></o:p></div>
<br class="Apple-interchange-newline">
</div>
</blockquote>
</div>
<div class=""><br class="">
</div>
<div class="">Even though you just hit refresh, the internal state of the MCB still thinks you submitted credentials for validation and so it runs the authentication leg of the cycle. There is no SSO or previous session.</div>
<div class=""><br class="">
</div>
<div class="">Since the MCB does not know what the credentials actually look like or what form fields the user might have filled out, it can’t make a judgement call that you just did a refresh. So it sends the request object to the submodule for authentication.
That submodule is querying your LDAP source, not the MCB itself. Then the submodule reports the fail and MCB counts it. I can’t think of a way to handle that scenario since the interface for submodules only allows a boolean return value. You kind of need a
tri-state variable: pass, fail, no-op.</div>
<div class=""><br class="">
</div>
<div class="">cheers,</div>
<div class=""><br class="">
</div>
<div class="">Paul</div>
<div class=""><br class="">
</div>
<br class="">
<div apple-content-edited="true" class="">-----<br class="">
Paul Hethmon<br class="">
Chief Software Architect<br class="">
<a href="mailto:paul.hethmon@clareitysecurity.com" class="">paul.hethmon@clareitysecurity.com</a><br class="">
<br class="">
</div>
<br class="">
</body>
</html>