Logon service failed login attempt

[Segi]

I am utilizing the logon service to authenticate my users with this code:

Code: Select all

try {
     system.securityManager.logon([["",fields.username],["",hashedPassword]]);
} catch (e) {
     // Parse the error message 
     var errormsg=String(e);
     
     // Remove this string from the beginning of the error message
     errormsg=errormsg.substring("JavaException: com.ebasetech.xi.exceptions.LogonException: ".length);
     
     alert(errormsg);
     
     event.stopExecution();
}

In the System Services->Scripts I have LOGON_SERVICE_JS which does the authentication:

Code: Select all

try {
     if ( tables.USERS.rowCount > 0 ) {  
          // Logon was successfull
     } else {
          fields.ERRORCODE.value = "999991";
          fields.ERRORDESCRIPTION.value = "Your username or password is not correct"; 
          print("Login failed with the username " + fields.PARAM1_VALUE.value);     
     }
} catch (e) {
   fields.USERID.value = null;   
   fields.ERRORCODE.value = "999991";
   fields.ERRORDESCRIPTION.value = "Your username or password is not correct";
}

If the user enters an invalid login, the else clause in LOGON_SERVICE_JS is triggered which displays a message that the login information is not correct and a default error message is written to the error console that says: "Mon Mar 16 10:45:51: Error invoking logon system service: Error invoking logon system service: error code 999991, Your username or password is not correct".

Is there a way to prevent this error message from being printed to the console ?

I want to only display my custom error message (which is above) which tells me the username that was used to attempt to log in.

[Jon]

This error message will contain both the ERRORCODE and ERRORDESCRIPTION fields set by the Logon Service if these are non null. There isn't any way of suppressing the message without also turning off all the other error logging. What is your concern? Do you think this might be a security exposure?

[Segi]

Jon,

I am not concerned about privacy so much since we only use eBase internally. I have been seeing many failed login attempts and have added a custom error message that is printed to the console after a failed login attempt to show me which username is failing to log in. I don't want the user to see this, it is only for my own purposes.

The only slight issue at the moment is that the Logon service prints out the standard error message and my custom error message so there are always 2 error messages printed. It is not a big deal but I was hoping I could suppress the Logon service error message