Automatic login

3
Is it possible to skip the login page by logging in automatically? A simple checkbox for automatic login would be nice. If checked, the user should not be asked for a password. How can i make this possible in the login.html?
asked
4 answers
5

There are a few possible solutions

For one, we have a Single Sign On (SSO) appstore module which logs in to the application based on windows account. We also have the MxID system but I'm not sure it's publicly available. This is the system that allows you to login to this forum as well as the Mendix developers network (MXDN).

answered
3

It comes down to what you "trust" from users as far as authentication is concerned. The cookie solution Michel proposes works fine, but is inherently insecure because anyone can simply set any cookie with a username of their choosing.

Bas offers a solution that will automagically login users that are already signed in to mxid (you use the same system to login to the forum), but that does mean that you need a valid mxid session (mxid serves as an authentication provider)

So, it would help us help you if you could tell us what you want to use as an authentication mechanism for each session (as sessions are non-persistant in mendix)

PS: thinking about it a little more, it seems as if you just want persistent sessions (ie, they don't expire at browser close). We don't support that at the moment, for security reasons. You can file a feature request in mxdn if this is something you really want.

answered
0

A solution might be:

In the login.html: Store the username in a cookie before submitting the login form.

In the index.html: Check the cookie, and if set, redirect to a deeplink, which invokes a microflow with the provided name, which invokes a java action which sets up a session for that user.

answered
0

A safer solution is to generate some random key and store it in a cookie and in the applications database (associated with the proper user). Then you can lookup this key on re-visits and set up a session for this user. If you extend the DeepLink module for this, i guess it is not too hard to set this up.

The MxID authentication is based on this approach (although the MxID approach is a bit more complicated to prevent cookie hijacking etc).

answered