Brute force attack prevention in Shibboleth IdP.

[Christopher Bongaarts]

On 7/1/2021 1:27 PM, Felipe Cardoso wrote:
> Is there any mechanism in Shibboleth IdP to mitigate brute force attack?
> Any suggestions for mechanisms (e.g. captcha) used by academic 
> federations with Shibboleth?

The Shib IdP has an account lockout function, where N failures in a 
period of time will automatically ignore further attempts for a while.  
It can be set up with any of the password-based authentication mechanisms.

https://wiki.shibboleth.net/confluence/display/IDP4/PasswordAuthnConfiguration#55804290b416c15d09ff41038f9e436f0cddc134

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%