We have a website which is content-rich. Users can gain access to the content if they have paid their membership fees. The website is hosted on a Domino server (which hosts a number of websites).
We have a request from a few universities where they want to allow their students to gain access to the website’s material - but only via their computers in their labs. They do not want to allow students to use the username/password on other computers outside the university complex.
Is this possible?
How could this be implemented?
Subject: Restricting access to a website via combination of ip-address and username?
If you want users to be able to connect and authenticate by username from certain ip addresses, you control this in a server/internet protocols/http/network setting section of the server document.
For most complex schemes the best way is to go with custom DSAPI filter.
Subject: RE: Restricting access to a website via combination of ip-address and username?
You can add the “Remote_Addr” field (computed Field, and the default value is Remote_Addr)This returns the IP address of the current user.
Then you can use the following formula in the “$$HTMLHead” Field:
returnpath:=@If(Remote_Addr = "xxx.xxx.xxx.xxx ";“logout?OpenForm”;“ok?OpenForm”);
“<META HTTP-EQUIV="refresh" content="0;url=” + returnpath + “">”
Subject: RE: Restricting access to a website via combination of ip-address and username?
But you may risk your customer laughing at you, when suggesting this …
Subject: RE: Restricting access to a website via combination of ip-address and username?
Why would they be laughing?
Subject: RE: Restricting access to a website via combination of ip-address and username?
The problem with this approach is, that the execution of
<META HTTP-EQUIV=“refresh” …
can be turned off in the browser configuration. No hacking required.
Subject: RE: Restricting access to a website via combination of ip-address and username?
Thanks for the idea - I guess this goes into the login-form?
I was thinking of putting something similar at the document level - hide the content if the username/ipaddress combination do not match.
Subject: RE: Restricting access to a website via combination of ip-address and username?
That’s grand for all usernames, but not I cannot implement this because we host multiple sites from the same server, also the ip-address restriction applies to a handful of usernames.