Shibboleth IdP in a WAF

[Dave Perry]

Surely you just farm this out to an AD based solution, or SAML proxy. This sort of thing is what Defender is built for.
We have ours monitoring everything, plus a separate SIEM solution (I can’t remember what it’s called - I don’t run cybersec) monitoring AD/Entra logins, and you trust a specific tool like that to work out if you’re under attack.

HTH
Dave

Sent from Outlook for iOS<https://aka.ms/o0ukef>
________________________________
From: users <users-bounces at shibboleth.net> on behalf of Matt Brennan via users <users at shibboleth.net>
Sent: Saturday, April 13, 2024 12:51:03 AM
To: users at shibboleth.net <users at shibboleth.net>
Cc: Matt Brennan <brennanma at gmail.com>
Subject: Shibboleth IdP in a WAF

Caution: Please take care when clicking on links or opening attachments in emails that originate from outside of the university. When in doubt, contact the ITS service desk.

I was wondering if anyone has any example rules how they configure blocking brute force attempts against the IdP. Certainly we have rules in place to lock out accounts which protects against brute force, but this doesn't stop an attacker who just wants to wreak havoc by intentionally locking out multiple accounts.

I've recently been trying to find a way to determine login failures, but with everything I try to do I cannot tell the difference between a failure versus a success and an MFA prompt (since both result in a 302 to execution=e1s2). I don't see any headers which indicate failure either.

Currently I'm just monitoring for too many 302s in a short time, but I've had a few legit users get locked out when they log in to multiple services in a short time (i.e. sitting down and starting their day).

Can anyone else share how they are accomplishing this? Is there a way to add a response header to indicate when a failure occurs?

TIA!
-Matt
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240413/315eac88/attachment.htm>