Hmmm , I am a little confused now ..
The username is hardcoded in the preauth.jsp . So for different users I need
something like this preauth.jsp?username=joe.smith ...
Now in our organisation everyone knows that username=firstname.lastname so everyone knows everyones' username . So anyone would be able to access anyone else's account just by supplying the query string once they realize where the URL preauth.jsp is . |