[java-identity-provider COMMIT] /trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/StorageBackedAccoun...

[noreply at shibboleth.net]

Author: scantor
Date: Thu Oct 13 21:59:47 2016
New Revision: 8490

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=8490&view=rev
Log:
IDP-156 - Create an authn lock-out stage

https://issues.shibboleth.net/jira/browse/IDP-156

Adjust counter comparison to fit standard usage.

Modified:
    trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/StorageBackedAccountLockoutManager.java

Modified: trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/StorageBackedAccountLockoutManager.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/StorageBackedAccountLockoutManager.java?rev=8490&r1=8489&r2=8490&view=diff
==============================================================================
--- trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/StorageBackedAccountLockoutManager.java	(original)
+++ trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/StorageBackedAccountLockoutManager.java	Thu Oct 13 21:59:47 2016
@@ -147,6 +147,7 @@
      * 
      * @param window counter window
      */
+    @Duration
     public void setCounterInterval(@Duration @Positive final long window) {
         ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
         
@@ -175,6 +176,7 @@
      * 
      * @param duration lockout duration
      */
+    @Duration
     public void setLockoutDuration(@Duration @Positive final long duration) {
         ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
         
@@ -243,7 +245,7 @@
         try {
             // Read counter and check if we've exceeded the limit.
             final int counter = Integer.parseInt(sr.getValue());
-            if (counter > maxAttemptsLookupStrategy.apply(profileRequestContext)) {
+            if (counter >= maxAttemptsLookupStrategy.apply(profileRequestContext)) {
                 // Recover time of last attempt from the record expiration and find the time elapsed since.
                 // If that's under the lockout duration, we're locked out.
                 final long lastAttempt =