Gathering e-signature on Perforce submit

Question

I've been working on a project to create an FDA part11-compliant e-signed document repository. The mandate is that it use Perforce to track the various revisions of the documents, utilize LDAP (AD) as the authentication/access directory, and re-authenticate the user at the point they submit a changelist.

The first two requirements are in place, but I am having trouble with the last one. I have a script at the "change-submit" trigger which logs out the user - assuming that this would force the client to re-authenticate the user before continuing with the process - but this does not work, at least for the command line client; the user is logged out but the process completes, and the next command attempt from the user is the one that gets denied.

Setting the script to handle the authentication process is not an option as it is run server-side and there is no way to pass a prompt through to the user.

I could of course pass authentication as command-line arguments to the script and then return non-0 to force the process to abort if the credentials are false, but I have not found a way to modify the commands sent for a given action by the p4v GUI, nor again to have the client prompt the user for authentication; and, this would result in the password being displayed as clear text consistently.

Setting the ticket timeout to an extremely short duration would definitely require the user to authenticate prior to submission, but also before any other action.

Has anyone out there dealt with something like this before, or does anyone see an angle of attack that I am missing? Thanks!

Answer 1

Well, I have no idea why it did not work for your client, but you can try this:
remove the p4tickets.txt file or remove the necessary line in this file after you logged out.

(After I log out I can see that one line (the line for the client I logged out) is removed from the p4tickets.txt.

Each time I have any problems with logging in/out I remove this file and it helps.

Answer 2

Thanks avp for your attempt to help, but my issue was not that the logout wasn't performed, but that the submit that triggered the logout script was concluded anyway.

I basically ended up setting up different groups, one which had all rights except write, and then a group for each authorized user which had write rights, but expired in 90 seconds. I then put all users in the non-write group, and then had a trigger set on login which parsed the password given to determine if it contained a request to join the group with write rights (which was set into a p4v script) and, if the remainder of the passed-in password was correct, assigned them to that group.

I've had it in production for a few months now with no issues.