IdP with MCB Redirecting to SP on failed login!

[Paul Hethmon]

That's it. A value of -1 should allow unlimited retries, at least in the MCB logic, individual auth modules could do there own thing.

Just be aware that logic had a bug at one point. GitHub may have an issue listed about it.

Paul


(Please enjoy the autocorrect features if this phone)

On Apr 3, 2015, at 2:45 PM, IAM David Bantz <dabantz at alaska.edu<mailto:dabantz at alaska.edu>> wrote:

Thanks!

I find the following in multi-context-broker.xml - is that the place to change?  Does a value of -1 create an unsafe vulnerability?


 <!--

        The maximum number of failures allowed a user before returning a SAML failure to the

        relying party. Must be specified according to schema definition. Set to a value of -1

        to allow an unlimited number of login failures.

     -->

    <maxFailures>3</maxFailures>



On Fri, Apr 3, 2015 at 10:37 AM, Paul Hethmon <paul.hethmon at clareitysecurity.com<mailto:paul.hethmon at clareitysecurity.com>> wrote:
There's an option for max fails in the MCB config. Set it to a higher value or disable it. I think there was a bug in some versions where the disabled option was not honored but setting it to 999 would definitely work.

Paul


(Please enjoy the autocorrect features if this phone)

On Apr 3, 2015, at 2:21 PM, IAM David Bantz <dabantz at alaska.edu<mailto:dabantz at alaska.edu>> wrote:

If a user fails authN at the IdP three times, our IdP is redirecting the browser to the SP.

That's generally not helpful, leaving the user on a generic SP error page.

Shibboleth IdP 2.4 with MCB.

I'm seeing the following suspicious entries in the IdP log:


10:10:57.478 - DEBUG [edu.internet2.middleware.assurance.mcb.authn.provider.MCBLoginServlet:207] - submodule process login returned [false]

10:10:57.478 - DEBUG [edu.internet2.middleware.assurance.mcb.authn.provider.MCBLoginServlet:312] - Current failed login count = [3]

10:10:57.478 - DEBUG [edu.internet2.middleware.assurance.mcb.authn.provider.MCBLoginServlet:156] - Authentication result = [true]

10:10:57.520 - INFO [Shibboleth-Access:73] - 20150403T181057Z|172.20.233.117|idp.alaska.edu<http://idp.alaska.edu>:443|/profile/SAML2/Redirect/SSO|

What's going on??

David Bantz

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150404/89809882/attachment.html