IdP with MCB Redirecting to SP on failed login!

[IAM David Bantz]

Thanks,

I set and verified a finite retry limit of 99; I don't expect any real user
to reach 99 (though I did to test) but won't allow some bot to endlessly
submit and trigger authN attempts.

On Fri, Apr 3, 2015 at 5:03 PM, Paul Hethmon <
paul.hethmon at clareitysecurity.com> wrote:

>   That's it. A value of -1 should allow unlimited retries, at least in
> the MCB logic, individual auth modules could do there own thing.
>
>  Just be aware that logic had a bug at one point. GitHub may have an
> issue listed about it.
>
>  Paul
>
>
>  (Please enjoy the autocorrect features if this phone)
>
> On Apr 3, 2015, at 2:45 PM, IAM David Bantz <dabantz at alaska.edu> wrote:
>
>   Thanks!
>
>  I find the following in multi-context-broker.xml - is that the place to
> change?  Does a value of -1 create an unsafe vulnerability?
>
>   <!--
>
>         The maximum number of failures allowed a user before returning a
> SAML failure to the
>
>         relying party. Must be specified according to schema definition.
> Set to a value of -1
>
>         to allow an unlimited number of login failures.
>
>      -->
>
>     <maxFailures>3</maxFailures>
>
>
>
>
> On Fri, Apr 3, 2015 at 10:37 AM, Paul Hethmon <
> paul.hethmon at clareitysecurity.com> wrote:
>
>>  There's an option for max fails in the MCB config. Set it to a higher
>> value or disable it. I think there was a bug in some versions where the
>> disabled option was not honored but setting it to 999 would definitely
>> work.
>>
>>  Paul
>>
>>
>>  (Please enjoy the autocorrect features if this phone)
>>
>> On Apr 3, 2015, at 2:21 PM, IAM David Bantz <dabantz at alaska.edu> wrote:
>>
>>   If a user fails authN at the IdP three times, our IdP is redirecting
>> the browser to the SP.
>>
>>  That's generally not helpful, leaving the user on a generic SP error
>> page.
>>
>>  Shibboleth IdP 2.4 with MCB.
>>
>>  I'm seeing the following suspicious entries in the IdP log:
>>
>>  10:10:57.478 - DEBUG
>> [edu.internet2.middleware.assurance.mcb.authn.provider.MCBLoginServlet:207]
>> - submodule process login returned [false]
>>
>> 10:10:57.478 - DEBUG
>> [edu.internet2.middleware.assurance.mcb.authn.provider.MCBLoginServlet:312]
>> - Current failed login count = [3]
>>
>> 10:10:57.478 - DEBUG
>> [edu.internet2.middleware.assurance.mcb.authn.provider.MCBLoginServlet:156]
>> - Authentication result = [true]
>>
>> 10:10:57.520 - INFO [Shibboleth-Access:73] -
>> 20150403T181057Z|172.20.233.117|idp.alaska.edu
>> :443|/profile/SAML2/Redirect/SSO|
>>
>> What's going on??
>>
>> David Bantz
>>
>>   --
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>>
>>
>> --
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>>
>
>   --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150403/890725cb/attachment-0001.html