Secure Login Scripting

David Guest

Technical Specialist

Novell UK

Broderick J. Harris
Senior Consultant
Protocom Development Systems

Agenda

Basics

What Does Nsure® SecureLogin Do

What is a script

What does a script see

How Does a script respond

Advanced

Building Blocks

Web Pages

Terminal Emulators

HLLAPI

The Basics

Secure Login Scripting

What does Secure Login Do:

Automatically logs a user in to an application

Secure Login Scripting

What Is A Script

Definition of the Login dialog for an application and insertion of ID and Password

The Eyes of NsureSecureLogin

The Keyboard of NsureSecureLogin

The rules behind what to type in, where and when

A set of logical commands for putting the ID and Password into an application

What Does The Script See

First the script looks for an application.

When the application starts it looks for a login page

Then it puts the ID and Password into the application

From the Login Screen we can see

Title

Text

Username

Password

OK

Cancel

The Log in Dialog

SecureLogin must also “see” these fields

The Log in Dialog

Using “Window Finder” we can see

Title – Log in

Username – Ctrl 1001

Password – Ctrl 1002

OK – Ctrl #1

Cancel – Ctrl #2

Window Class - #32770

Window Finder

Demonstration

Log In Dialog Script

A sample script for the log in dialog would be

Dialog

Class "#32770"

Title "Log in"

Ctrl #1

Ctrl #2

EndDialog

Logging In

Now we have identified the screen we need to

Insert the Username

Insert the Password

Press OK

Doing the Log In

We already know the Field identifiers for Username, Password and OK so the script would be

Type $Username #1001

Type $Password #1002

Click #1

Variables

The $ indicates that the value is stored within eDirectory

Advanced

Building Blocks

Each NSL script should contain a number of standard sections

Win32

Emulator

Web

Java

Identifiable Sections

Script Sections

A script should contain the following sections:

Script Header

Log In Dialog

Change Password Dialog

Password Expiration

Log In Failure

Log in success (Mostly in Terminal Emulation)

Other Message Detection

Script Header

At the start of each script

#############################################

#

# Application :

#

# Application Description :

#

# Initial Script created on :

# by :

#

#############################################

#

# Modification Log

#

# Modified By - Date (yyyymmdd) - Description

#

# e.g. David Guest - 20040302 - Initial Script Creation

#

#############################################

Log In Dialog

Respond to Log In Dialog

Detect Log In Screen

Complete Details and submit

#Begin Login In Dialog Recognition and response

Dialog
Class "#32770"
Title "Log in"

EndDialog

Setprompt "Username:"

Type $Username #1001

Setprompt "Password:"

Type $Password #1002

SetPrompt “Please enter credentials for Application”

Click #1

Change Password

Change Passwords must be managed

Dialog
Class "#32770"
Title "Change Password"

EndDialog

Type "$Username" #1015\

Type "$password" #1004

ChangePassword ?NewPassword

Type ?NewPassword #1005

Type ?NewPassword #1006

Click #1

Set $Password ?NewPassword

Password Expiry

Does the application support password expiry

Single Message Box with

Old Password

New Password

Confirmation

Dual Message Boxes

Old Password and New Password

Confirmation

The script routine to change the password should be similar to the change password section.

Remember each Dialog must be handled separately

Login Failure

What Happens if you fail to log in

Error Dialog

What happens after the error. Control passes to:

The original window with no update

A new login window

Each must be handled differently

Dialog
Class “#32770”
Title “Logon Failure”

EndDialog

DisplayVariables “Your login attempt has failed. Please confirm your Username and Password.“ $Username $Password

Click #2

Type -Raw $Username

Type -Raw \T

Type -Raw $Password

Type -Raw \N

Catching Repeated Failures

Make sure that the script does not loop

How many attempts should the user be allowed

Count The Failures

Keep The User informed

Eventually Close the Application

Dialog
Class “#32770”
Title “Logon Failure”
EndDialog
Increment ?FailCount
If ?FailCount lt 3
DisplayVariables “Your logon attempt has failed. Please confirm

your Username and Password.“ $Username $Password
Click #2
Else
MessageBox “The Username and password are still incorrect.

Please contact the help desk for more details.”
KillApp “AppTester.exe”
EndScript
EndIf

Other Messages

Application Messages

Foreign Language

Future Password Expiry

Advisory Technical Messages

Standard Information Dialog

Dialog
Class “#32770”
Title “Information”
EndDialog

ReadText #65535 ?Message

If ?Message eq “Welcome to the application”

Click #1

EndIf

If “Your password will expire in” -In ?Message

Click #2

Endif

If “The system is going down for maintenance in 5 minutes”

MessageBox “Watch out the system is going down very soon”

EndIf

Login Success

Detect when the user has succesfully logged in

Used to reset counters

Break out of Repeat/EndRepeat loops

Used extensively with Terminal Emulation

Generic and Advanced Generic Emulators

Terminal Emulators

Working with Terminal Emulation

Different Emulator Types

Generic

Advanced Generic

HLLAPI

DDE

Two Groupings

Generic and Advanced

HLLAPI and DDE

Generic and Advanced Generic

Screen Scrape

Read Complete Screen

Cut and Paste

Screen Flash

Script must be stopped before user can operate

Repeat Loop

Search for password related messages

Search for First User Menu

End Script

Password Change within Application

Not supported

HLLAPI and DDE Emulators

HLLAPI and DDE

No Screen Scraping

Read Specific Portions of the Screen

ReadText ?Variable Column Row

Standard Messages (IBM S/390)

Removes “Blinking”

Handle specific messages as they occur

Application Password change supported

Emulation Scripts

Things to look for

Login

Password

Failure ?

Expiry

MOTD

Standard

Informational

Partial Text

Example Emulation Script

WaitForText “ogin:”

Type $Username

Type @E

WaitForText “assword:”

Type $Password

Type @E

Emulation Demonstration

Demonstration

Example Emulation Script 2

WaitForText “ogin:”

Type $Username

Type @E

WaitForText “assword:”

Type $Password

Type @E

Repeat

# Check for failed login

Increment ?ScreenCount

If ?ScreenCount eq 1

If -Text "ogin incorrect"

Increment ?RunCount

if ?RunCount eq 1

DisplayVariables "Please re-enter your ID and Password”

Type $Username

Type @E

Delay 500

WaitForText "assword:"

Type $Password

Type @E

Endif

EndIf

#Check for password expiry

If -Text "New Password:"

If ?PasswordChange eq <notset>

Set ?PasswordChange 1

ChangePassword ?NewPassword "Your password must be changed."

Type ?NewPassword

Type @E

Endif

Endif

EndIf

If ?PasswordChange eq 1

If -Text "e-enter new Password:"

Type ?NewPassword

Type @E

Endif

Endif

If -Text "Press RETURN key to continue....."

Type @E

Endif

If -Text "MENU"

EndSplashScreen

if ?PasswordChange eq 1

Set $Password ?NewPassword

Set ?NewPassword <notset>

endif

Set ?PasswordChange <notset>

Set ?ScreenCount <notset>

break

endif

EndRepeat

EndSplashScreen

if ?PasswordChange eq 1

Set $Password ?NewPassword

Set ?NewPassword <notset>

endif

Set ?PasswordChange <notset>

Set ?ScreenCount <notset>

break

endif

EndRepeat

Example Script Continued

Web Scripts

Web Scripts

Simple Web Script

Inserts Username and Password

Uses Field Names

Type $Username

Type $Password password

Submit or Click

Automatic or Manual

Web Scripts

Issues

Log In when logging out

Not active on some pages

Inserting Username and Password on the wrong pages

Password Control

Only (normally) works when password field is visible

Intelligent Web Scripts

Allow the script to determine what to do

Don't log in after logout

What page are we viewing

Is there a password field

Web Scripting

Web applications consist of two key structural elements:

Address (unique URL or IP address)

Series of pages, each offering different views/data and operations

To detect a page, SecureLogin generally does a combination of:

Checking the URL

Matching for a page title

Matching for specific text within the HTML

Looking at the names of input fields within forms

Web Scripting

SecureLogin can be told to handle the pages from a web site in two ways:

Platform-per-page approach. Using this approach each page requiring some action has its own SecureLogin platform.

http:\\127.0.0.1\login.html

http:\\127.0.0.1\changepassword.html

Platform-per-site approach. Alternatively, SecureLogin can monitor every page at a specific web site, with the script determining which page(s) to process

http:\\127.0.0.1

Generally, the second option is typically simpler, more robust and easier to maintain.

Web Scripting

Using the platform-per-site approach, the following basic structure is suggested:

if –text “page 1 unique text”

commands

endif

if –text “page 2 unique text”

commands

endif

Note:

Make sure you deselect ‘Password must exist’ option. Otherwise, if the page you want to process doesn’t have a password, nothing will happen!

Using this approach, SecureLogin will run the script against each page on the web site.

EndScript

Web Scripting Demonstration

Demonstration

Example Web Script

###########################################################

# Standard login window handling

if -text "PDS-SLD-Login"

type $Username #1

type $Password #2

submit

endif

###########################################################

# Password expiration handling

if -text "PDS-SLD-PasswordExpired

messagebox "SecureLogin has detected that your password has expired - it will be automatically reset"

click #2

endif

###########################################################

# Password change handling

if -text "PDS-SLD-ChangePassword"

Set ?oldpass $password

OnException ChangePasswordCancelled Call UserCancelled

ChangePassword $password random

Type ?oldpass #1

Type $password #2

Type $password #3

Submit

endif

Example Web Script Continued

Sub UserCancelled

Messagebox "You cannot cancel the password change dialog box. Please change your password"

OnException ChancePasswordCancelled Call UserCancelled

ChangePassword $Password

Type ?oldpass #1

Type $password #2

Type $password #3

Submit

EndSub

###########################################################

# Locked account

if -text "PDS-SLD-AccountLocked"

messagebox "Sorry, your account has now been suspended for security reasons. Please contact the help desk."

killapp "iexplore.exe"

endscript

endif

###########################################################

# Incorrect credentials handling

if -text "PDS-SLD-BadCredentials"

displayvariables "Sorry, but your password is not correct...Please enter your correct password"

gotourl http:\\127.0.0.1\sld-htmllogin.html

endscript

endif

###########################################################

# End of script

click #200

Summary

Use Building Blocks

Look for Failures as well as Success

Examine how the application handles passwords

Look for Unusual Messages

Standard (Model) Sections

1

2

3

4

5

Other SecureLogin Sessions

TUT 195 Product Futures

Mon 3/21 4:15 PM

Tue 3/22 2:30 PM

TUT 283 Advanced Deployment Strategies In An Age Of Regulatory Compliance.

Fri 3/25 12:30 PM

Q & A

Ask Away

Ask Away

Secure Login Scripting

An introduction to Secure Login Scripting

2003-12-08T12:43:39