Shibboleth IdP in a WAF

[Matt Brennan]

I was wondering if anyone has any example rules how they configure blocking
brute force attempts against the IdP. Certainly we have rules in place to
lock out accounts which protects against brute force, but this doesn't stop
an attacker who just wants to wreak havoc by intentionally locking out
multiple accounts.

I've recently been trying to find a way to determine login failures, but
with everything I try to do I cannot tell the difference between a failure
versus a success and an MFA prompt (since both result in a 302 to
execution=e1s2). I don't see any headers which indicate failure either.

Currently I'm just monitoring for too many 302s in a short time, but I've
had a few legit users get locked out when they log in to multiple services
in a short time (i.e. sitting down and starting their day).

Can anyone else share how they are accomplishing this? Is there a way to
add a response header to indicate when a failure occurs?

TIA!
-Matt
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240412/3d95d894/attachment.htm>