IdP with MCB Redirecting to SP on failed login!

[IAM David Bantz]

Thanks!

I find the following in multi-context-broker.xml - is that the place to
change?  Does a value of -1 create an unsafe vulnerability?

 <!--

        The maximum number of failures allowed a user before returning a
SAML failure to the

        relying party. Must be specified according to schema definition.
Set to a value of -1

        to allow an unlimited number of login failures.

     -->

    <maxFailures>3</maxFailures>




On Fri, Apr 3, 2015 at 10:37 AM, Paul Hethmon <
paul.hethmon at clareitysecurity.com> wrote:

>  There's an option for max fails in the MCB config. Set it to a higher
> value or disable it. I think there was a bug in some versions where the
> disabled option was not honored but setting it to 999 would definitely
> work.
>
>  Paul
>
>
>  (Please enjoy the autocorrect features if this phone)
>
> On Apr 3, 2015, at 2:21 PM, IAM David Bantz <dabantz at alaska.edu> wrote:
>
>   If a user fails authN at the IdP three times, our IdP is redirecting
> the browser to the SP.
>
>  That's generally not helpful, leaving the user on a generic SP error
> page.
>
>  Shibboleth IdP 2.4 with MCB.
>
>  I'm seeing the following suspicious entries in the IdP log:
>
>  10:10:57.478 - DEBUG
> [edu.internet2.middleware.assurance.mcb.authn.provider.MCBLoginServlet:207]
> - submodule process login returned [false]
>
> 10:10:57.478 - DEBUG
> [edu.internet2.middleware.assurance.mcb.authn.provider.MCBLoginServlet:312]
> - Current failed login count = [3]
>
> 10:10:57.478 - DEBUG
> [edu.internet2.middleware.assurance.mcb.authn.provider.MCBLoginServlet:156]
> - Authentication result = [true]
>
> 10:10:57.520 - INFO [Shibboleth-Access:73] -
> 20150403T181057Z|172.20.233.117|idp.alaska.edu
> :443|/profile/SAML2/Redirect/SSO|
>
> What's going on??
>
> David Bantz
>
>  --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150403/a5a9ab1a/attachment-0001.html