6

Is there a way in Apex/Visualforce to prompt the user for their password even if they are already logged in? Basically, I have a request for a user to re-authenticate them self when they fill out a VF page. This is to make doubly (triply?) sure that the person making the change is really the person logged in. For example, what if a manager gets up and walks away from their computer without locking/logging out and a subordinate sneaks in and approves a request. (Yes, trust levels are a little low)

Improve this question
4
  • Note this would also prevent admins from performing these actions as users they can otherwise log in as. Neither good nor bad at face value, just something to think about.
    – Adrian Larson ♦
    Jul 29, 2015 at 22:08
  • Yes, that would be the preferred result as well.
    – Daniel Hoechst
    Jul 29, 2015 at 22:10
  • 1
    AFAIK it's impossible...but it sounds like a great feature. If someone can confirm it doesn't yet exist you should post it on the Ideas Exchange.
    – Adrian Larson ♦
    Jul 29, 2015 at 22:12
  • 2
    An alternative would be to provide a mechanism for the user to create a PIN that is stored in an encrypted field and then prompt for that PIN instead of a password. That's what we have in another application, but it is a pain. I always forget my PIN since I use it rarely.
    – Daniel Hoechst
    Jul 29, 2015 at 22:14

2 Answers 2

Reset to default
1

Looks like there is a solution in the Force.com cookbook. It involves setting a remote site up for the login site for your domain and then making a SOAP login call in Apex. There are several drawbacks to this solution: you need a remote site setting that changes depending on sandbox or production and security tokens may be required.

Improve this answer
1

There's now standard and high-assurance session levels available in the security setup. You can declaratively force people to have a high assurance session to export reports, for example.

Fortunately, all that stuff exists in apex as well, so I think your code could look at the session level to see how good it is.

There's also some built-in OTP methods on there, too, in case you want to email them an OTP and have your page ask for it.

I've never used any of this, so let me know if anything ends up working.

See:

https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_enum_Auth_SessionLevel.htm?search_text=assurance

and

https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_class_Auth_SessionManagement.htm?search_text=assurance#apex_class_Auth_SessionManagement

Improve this answer
3
  • Even if it is a high-assurance session, that doesn't protect against a user leaving a computer unlocked and walking away.
    – Daniel Hoechst
    Jul 30, 2015 at 14:01
  • right--then sounds like the OTP option might be the best? or use the apex class to downgrade their session so they have to do it again right then. :)
    – Shane McLaughlin
    Jul 30, 2015 at 19:28
  • @DanielHoechst - Looking into a similar use case. You can lower the session back (if for example OTP solution would be chosen) after the logic for which a higher assurance is required.
    – Robin Wijnen
    Aug 30, 2017 at 12:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .