Log in function locking users that introduce a wrong password many times

Question

I need to create a log in function that validates the username and the password and blocking or locking users that introduce a wrong password many times in a specific period of time. The idea is when it happens, the user has to call the administrator of the system to be unlock.
Thanks for your help.
Edited by: user13486053 on Jan 6, 2011 6:47 AM

Answer 1

If your are using custom authentication,
<li>There is an bultin table which contains the login acess attempts of users: APEX_USER_ACCESS_LOG , You might be interested in the columns APPLICATION,LOGINNAME,ACCESS_DATE,AUTHENTICATION_RESULT_ .
However, inorder to set the authentication_result column(therby identify failed attempts), you would have to call the APEX_UTIL.SET_AUTHENTICATION_RESULT function in your authentication function. Otherwise it would be null both for success and failure cases.
Try this, for finding failure count in last <failure check period>
select count(1)
from APEX_USER_ACCESS_LOG
where application = [APP_ID]
and   login_name = [username] --case sensitive
AND   authentication_result = [failure status]
and   SYSDATE - access_date <= [failure check period]For locking out you would have to flag some column in your custom table and show the user some message in the login page
If you want to use your own table, here's an approach
   Have a table for logging user's login status and time.
   In ur authentication function, you can write to this table everytime a login fails if its succesful u can remove previous 'failure' entries and create a 'success' entry.
   Use count the number of failures within that time period u want say 24 hrs (SELECT count(1) from <table name> where SYSDATE - <DATE column> LESS THAN 1 Day).
    If the count is more than ur required no: flag the users record as locked(have some column updated)
    In your login page, have some conditional region with some text which says the user's account is locked out(the condition can be locked column status of the user who tried to login, use the username page item for identifying the user)Hope it helps