Password lockout approach

[Christopher Bongaarts]

One of the custom bits in our v2 LoginHandler is a "if a username+IP 
tries X bad passwords within Y minutes, lock out further attempts for Z 
minutes".  Apparently no one had done this in the IdP previously when I 
asked on the list at that time.

v3 contains (mostly) built-in support for respecting a lockout flag in 
the underlying auth system, but we want to do this in the IdP itself 
(primarily so we can avoid denial of service by including the browser 
IP).  I'm looking to see if there are any suggestions as to where to 
plug this in.  I'd also like to do this in a relatively generic manner 
so others could make use of it.

It seems to me that the lockout concept would apply specifically to 
username/password authentication, and not other methods like X.509, but 
that it would not depend on the specific password backend (LDAP, 
Kerberos, etc.).  I'd consider the lockout "key" to be configurable, so 
I could use a stringified "username+IP", and someone else could use just 
username or IP by itself.

I see three operations that need to be plugged in:

1. If the attack counter for the key has reached the threshold and 
hasn't expired, "throw" (transition to state?) AccountLockedOut
2. If password verification succeeds, clear the attack counter.
3. If password verification fails, increment the attack counter, and set 
the initial timestamp if the counter is 1.

I'm wondering if most/all of these could/should be implemented in 
flows/authn/conditions/conditions-flow.xml#ValidateUsernamePassword, as 
it appears to be the "parent" state of the ValidateUsernamePassword 
state in the actual password-flow.

The other question would be where the attack counter/timestamps should 
be stored.  They need to persist beyond the individual flows, so flow 
scope variables seem to be out.  The various storage service APIs seem 
like they fit pretty well, but would we need to configure an separate 
storage service instance for this? Particularly if the default is to use 
cookies in the browser....

Any tips would be appreciated.  My Spring know-how is pretty limited, 
but I'm trying to absorb it as quickly as I can.

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%