AuthCode on IPO11 [Strictly on Phone]

[makemetrend]

Hi Tektips,

May I ask if it's possible to assign a specific authcode to a certain extension number,
For example,
Authcode - 556 , Extension - 300 and 301
Only extension 300 can use the 556 authcode? and extension 301 can't use the 556 authcode?

 

[sizbut]

Maybe start with saying why you don't want to use Authorization Codes for this?

Stuck in a never ending cycle of file copying.

 

[makemetrend]

hi sizbut,

actually we will use authorization code for this. im just asking if this is possible on the subject above.. we are using ipo server edition.

 

[sizbut]

Still don't get you. There is nothing stopping you issuing an auth code to user 300 and then setting a 9 prefix short code (or whatever you use for external calls) with Force Authorization set in their user short codes. Works for them and only for them.

Stuck in a never ending cycle of file copying.

 

[makemetrend]

Thanks sizbut.

Because in our client they're experiencing. For example,

Authcode - 556,557 Extension/User - 300/Alice and 301/Bob

Bob is using 557Autcode and also he can use the authcode 556. We need to verify if it's possible to restrict Bob on using only the 557AuthCode?

Because in IPO 11 when we assigned Bob on the extension 557 and save it. He can still use the authcode 556 for external calls.

 

[sizbut]

And you're surprised. If they know the auth code they can use it. If I know your bank account password I can use it. I assumed that 556 was just an example. Using 3-digit authorization codes for real is asking for hacking. Using sequential 3-digit authorization codes is just plain stupid. Sack Bob for using someone elses code, and then sack whoever setup a system with sequential 3-digit codes.

Stuck in a never ending cycle of file copying.

 

[makemetrend]

that was just an example sizbut. of course we will configure a random generated authorization code.

Well, that's the problem of the client. The user is giving their authorization code to another user and they can't stop it.

 

[sizbut]

Yes, they can. If users are abusing/misusing a company resource, you sack them. If their not employees, who are they? If customers, you bill them and then ban them.

If two users swap auth codes, login codes, user passwords, whatever - then they can't be blocked by the IP Office system - its phone's don't have fingerprint or iris recognition as yet, no multi-factor authentication.


Stuck in a never ending cycle of file copying.