Authentication

Card

As an Administrator I want to deny access to unauthorised users so that the purchase order data is secure.

This user story is implemented under this issue.

Related User Stories:

• Authorisation
• Users Table and Maintenance Forms
• Use Microsoft Active Directory for Authentication

Conversation

Initially use basic custom authentication setup with login and encrypted password or possible open-source solutions. Standard Users table setup will still be used for authorisation if Microsoft Active Directory is used for authentication later. For now, no password change mechanism will be implemented - password setup and changes will be handled by the admin user.

Questions

1. Is the existing intranet secured by login and password? If so, would it be better to try to hook into this for authentication purposes so that the user doesn't have to log in twice? Yes, the intranet retrieves user data from Microsoft Active Directory. It would be good to use this for authentication as long as managers are reminded to keep their computers secure and lock their screens when away from their desk.

Confirmation

1. Logout if login form not displayed.
2. Press Login without entering user id or password and ensure login form is redisplayed with 'Invalid user/password' combination.
3. Repeat 2 with non-existent user.
4. Repeat 2 with invalid password.
5. Enter valid user id and password and ensure successful login.