Hi all,
I'm implementing an authentication mechanisme with user, password and recaptcha verification in the same login page.
I mooved the login page from webseal to an AAC infomap using a local-response-redirect for login operation.

Now I want to configure the recaptcha to compaire only after a failed attempt login.
Which is the best way to configure that use case?
A
1 infomap without recaptcha that set a session variable ( in unauthenticated user's session ) when you click submit
2 the infomap verify if the session's variable is already present and if it's present it performes a redirect to another infomap with recaptcha


B
1 only one infomap that set a cookie if you have already clicked submit
2 the HTML page verify the cookie presence to load the recaptcha verification

C
only one infomap that verify if in query string ther's an authentication error to load eventually the recaptcha.

I would to know which is the best practise, if someone has already implemented this scenario, because I think that the logic on the html page may be bypassed.
I'd appreciate your point of you.

Thank you

------------------------------
Ivana Campolongo
------------------------------

Hello Ivana,

I think I would have 1 InfoMap but 2 page templates (one with reCaptcha embed and one without).  The InfoMap would check whether this is first attempt and set the page template to be used for challenge based on this.

Of course you'd also need to have logic in the backend InfoMap to only check the result of reCaptcha if it had been requested.

Cheers... Jon.

------------------------------
Jon Harry
Consulting IT Security Specialist
IBM
------------------------------