Web script is entering UserID and Password into fields on multiple pages, not just the login page

Issue

The customer is SSO enabling a web page. They began by developing the following application definition (formerly called script) for the web site. They plan to handle all errors (invalid UserID, invalid password etc.) but are just testing the basics at this stage.

The application name is intranet.hrsystem. Whenever embedded fields exist on a page (e.g. the username and password fields in hotmail are examples of fields you can type into, as are other fields in other systems such as phone numbers, address details etc.) that has intranet.hrsystem in the URL, SecureLogin will attempt to enter the UserID into the 1st field and the Password into the 2nd field.

For example, the script executes and enters the data into the correct fields on the following page;

hrsystem.intranet/logon.htm

and also enters the data into the telephone number and address fields on the following page;

hrsystem.intranet/personaldetails.htm

The customer wants SecureLogin to ONLY enter the data at the logon page.

#===============# 
# Logon Prompt # 
#===============#

SetPrompt ""HR UserID:"" 
Type $UserID #1 
SetPrompt ""HR Password:"" 
Type $Password #2 
Submit 
SetPrompt ""Please enter your logon credentials for the web site.""

Cause

SecureLogin is behaving as designed and the application definition must be edited to instruct SecureLogin to only enter the credentials at the logon prompt. It will execute the above application definition every time the full URL or partial URL specified in the application name exists in the URL of the web page being accessed (in this case, whenever intranet.hrsystem is present in the URL).

The SSO administrator must be more specific when creating the application definition.

Solution

SecureLogin is extremely flexible and customizable. SSO administrators can configure SecureLogin to enter the text into fields on specific pages in a number of ways, depending on their requirements.

1. Edit the application definition and search for some text using If -Text specific to the logon page, for example, ""Please logon"". SecureLogin will only execute the script and enter data if the text exists on the web page.

#============================================================# 
# Logon Prompt # 
# If this text appears on the page, we are at the logon page # #============================================================# 
If -Text ""Please logon:"" 
SetPrompt ""HR UserID:"" 
Type $UserID #1 
SetPrompt ""HR Password:"" 
Type $Password #2 
Submit 
EndIf 
SetPrompt ""Please enter your logon credentials for the HR web site.""

2. Edit the application definition and search for part of the URL using GetURL and the If command, specific to the login page, for example, ""logon.htm"". SecureLogin will only execute the script if the URL is at the logon page.

#================================================# 
# Read the URL and save it to a Temp variable # 

#================================================# 
GetURL ?HRSystemURL 

#==============================================================# 
# Logon Prompt # # If this part of the URL appears we must be at the logon page # 
#==============================================================# 
If ""logon.htm"" -In ?HRSystemURL 
SetPrompt ""HR UserID:"" 
Type $UserID #1 
SetPrompt ""HR Password:"" 
Type $Password #2 
Submit 
EndIf 
SetPrompt ""Please enter your logon credentials for the HR web site.""

3. Option 3 is to delete and recreate the Advanced Web application definition using the full URL name (i.e. specific URL) of the logon page so that is the only page the script executes for i.e.

intranet.hrsystem/logon.htm

In the above example, the script will only execute and enter data when intranet.hrsystem/logon.htm is the URL. However, this means you will probably have to create a separate application definition using the names of the sites you must detect including error handling, change password etc.