MCB bug on failed logins?

[Paul Hethmon]

On Apr 28, 2015, at 2:45 PM, Ho, PeiQuan <PeiQuan.Ho at tufts.edu<mailto:PeiQuan.Ho at tufts.edu>> wrote:

                I’m running some testing on the IDP with MCB.  I noticed that when I’m directed to the IDP login page and I simply don’t login and just refresh the page, the MCB regards this as an SSO session and tries to query LDAP  using a null user.  This fails of course.  But it also increments the failed login count.    The odd thing is in the logs, it shows that there was actually no previous session found, but the MCB still thinks it is SSO.  Is this the place to be reporting possible MCB bugs?


Even though you just hit refresh, the internal state of the MCB still thinks you submitted credentials for validation and so it runs the authentication leg of the cycle. There is no SSO or previous session.

Since the MCB does not know what the credentials actually look like or what form fields the user might have filled out, it can’t make a judgement call that you just did a refresh. So it sends the request object to the submodule for authentication. That submodule is querying your LDAP source, not the MCB itself. Then the submodule reports the fail and MCB counts it. I can’t think of a way to handle that scenario since the interface for submodules only allows a boolean return value. You kind of need a tri-state variable: pass, fail, no-op.

cheers,

Paul


-----
Paul Hethmon
Chief Software Architect
paul.hethmon at clareitysecurity.com<mailto:paul.hethmon at clareitysecurity.com>


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150429/38d5ddbe/attachment.html>