3

What Needs to Happen: When a user logs into the org, we perceive the attempt as either Successful (correct password), Failed (incorrect password), or Other. If the user fails the login attempt, a User object field 'Failed Attempt Counter' is increased by 1. Once the counter reaches 3, an email is sent.

The Problem: The process above has been created using a Flow/Process Builder, however, since Login Flows are only invoked post-authentication, the Flow only every updates when their is a Successful login attempt. I can call the Flow I've created if I can find a way to invoke it every time a User attempts to log in, but I can't call LoginHistory from a trigger, and the Flow won't start until their is a Successful login attempt.

Question: How do I invoke Apex/Flow/Process Builder Flow whenever someone logs in? Is there a better solution?

The Flow in case you are interested (though not necessary to answer my question): Flow

  • is it password reset mail you send when that counter reaches 3? – Pranay Jaiswal Nov 15 '18 at 18:47
  • @Pranay, it is not. The email is sent to Security to alert them of the numerous failed attempts. – paulK Nov 15 '18 at 18:48
  • if you know we can lock user after some password attempts.. we can also configure that except admin none can unlock the usert – Pranay Jaiswal Nov 15 '18 at 18:52
  • @pranay, if I'm understanding you correctly, you are saying we should look at the locked user field that is updated on LoginHistory object when a user is locked out and trigger the event from there. Unfortunately, you can't call from Apex. – paulK Nov 15 '18 at 18:57
  • @PranayJaiswal and you cannot invoke a flow unless you use Process Builder and Process Builder doesn't have access to the Login History object... – paulK Nov 15 '18 at 18:58
4

You cannot run a process builder/trigger/workflow without logging in.

The best you do is with invalid password then lockout the user. Set the lockout effective period to forever, then show a locked user a page asking them to email the admin/security team. By this way, the security team will always know whats going on with users.

enter image description here


Another Approach will be to schedule a Scheduler every 30mins to 1 hour.

The scheduler will query LoginHistory table for LoginTime=Today

SELECT ApiType,ApiVersion,Application,AuthenticationServiceId,Browser,CipherSuite,ClientVersion,CountryIso,Id,LoginGeoId,LoginTime,LoginType,LoginUrl,NetworkId,Platform,SourceIp,Status,TlsProtocol,UserId FROM LoginHistory where LoginTime=Today

Then iterate over the records to find a record where status='Invalid Password' (You cannot use status field as filter on query for LoginHistory)

Once found gather it, make a set and then send an aggegate email to the System's team

  • Thanks for the information. I'm aware of this option, but it is not a solution. Here Salesforce provides some information on handling login exceptions and make it seem that what I'm talking about is possibe, but there is little detail on triggering this and where: help.salesforce.com/articleView?id=000212767&type=1 – paulK Nov 15 '18 at 19:26
  • @paulK i have updated my answer to include use of Login History Scheduler. – Pranay Jaiswal Nov 15 '18 at 19:27
  • Ok that is an interesting idea. I know they have scheduler limits that are 250k so this might work. However, it does seem like just running code for no reason. Not very efficient. Crazy there isn't a solution for this from Salesforce. – paulK Nov 15 '18 at 19:30
  • 1
    Ok. I'm going to meet with a couple other experts today about this. If no better solution, I'll mark yours as the best. Thanks again, Pranay! – paulK Nov 15 '18 at 20:13
  • 1
    Hey @Pranay I haven't forgotten about you. Expecting to hear back this week. Will update when I have an answer from their team. – paulK Nov 19 '18 at 17:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.