Checking of logon trials

To log on to CAS genesisWorld with the Windows authentication, you have 3 options:

• LDAP access,
• Hash value, or
• ntuser - this kind of logon is also made via Windows, but does neither require LDAP access nor a hash value.

For all 3 possibilities applies: a Windows account can be locked after several false entries. This lock can also occur because the different ways of authentication for CAS genesisWorld are checked. The logon is checked by CAS genesisWorld in the following order:

• If an LDAP access is configured, the logon is checked via the first LDAP server. If this LDAP server is not available, the check is performed via a second LDAP server if this server is configured.

If one of the two LDAP servers is accessed and the logon data is incorrect, the logon is terminated. A message is displayed that the user or password is incorrect.

• If no LDAP server can be accessed, the password is checked with the hash value which has been stored in CAS genesisWorld.
• If no LDAP server can be accessed, the system checks whether the Active Directory can be accessed directly. If yes and the password is incorrect, then the logon process is canceled.
• If the Active Directory is not available, then the logon is checked locally with the LogOnUsers API function of Windows.

To be able to successfully log on with the API function, the LOGON32_LOGON_NETWORK parameter type is required.

If a laptop is used offline and without a configured LDAP access, the Interface not supported error might occur with the Windows server on the laptop. This can be prevented via the Windows server: After a logon attempt with LogOnUser, the hash value can also be checked.