Shibboleth IdP in a WAF

[Simone Lanzarini]

Il 13/04/24 01:51, Matt Brennan via users ha scritto:
> I was wondering if anyone has any example rules how they configure 
> blocking brute force attempts against the IdP. Certainly we have rules 
> in place to lock out accounts which protects against brute force, but 
> this doesn't stop an attacker who just wants to wreak havoc by 
> intentionally locking out multiple accounts.
>
> I've recently been trying to find a way to determine login failures, 
> but with everything I try to do I cannot tell the difference between a 
> failure versus a success and an MFA prompt (since both result in a 302 
> to execution=e1s2). I don't see any headers which indicate failure 
> either.
>
> Currently I'm just monitoring for too many 302s in a short time, but 
> I've had a few legit users get locked out when they log in to multiple 
> services in a short time (i.e. sitting down and starting their day).
>
> Can anyone else share how they are accomplishing this? Is there a way 
> to add a response header to indicate when a failure occurs?
>
> TIA!
> -Matt
>
Hi Matt,

there's a built-in IDP feature that I found very effective in blocking 
brute force attempts and that avoids DDOS attacks and that doens't 
require you to setup a dedicated WAF, or to implement policies at LDAP 
level:

https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505587/PasswordAuthnConfiguration#Advanced-Features


The idea is to block a specific user login attempt coming from a 
specific IP address. In this way, unless attacker ad victim are behind 
the same network, you can lock only evil attempts leaving legitimate 
accesses available.

This is an example bean definition:


<beanid="shibboleth.authn.Password.AccountLockoutManager"
parent="shibboleth.StorageBackedAccountLockoutManager"
p:maxAttempts="5"
p:counterInterval="PT50S"
p:lockoutDuration="PT20S"
p:extendLockoutDuration="false"/>


Simone

www.cineca.it
Simone Lanzarini
Direzione Tecnologie, Sistemi e Infrastruttura
Sede di Bologna
via Magnanelli 6/3, Casalecchio Di Reno
+39 0516171773
s.lanzarini at cineca.it
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240413/a466c8de/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image948881.png
Type: image/png
Size: 1012 bytes
Desc: image948881.png
URL: <http://shibboleth.net/pipermail/users/attachments/20240413/a466c8de/attachment.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image790440.png
Type: image/png
Size: 896 bytes
Desc: image790440.png
URL: <http://shibboleth.net/pipermail/users/attachments/20240413/a466c8de/attachment-0001.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image534142.png
Type: image/png
Size: 329 bytes
Desc: image534142.png
URL: <http://shibboleth.net/pipermail/users/attachments/20240413/a466c8de/attachment-0002.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image922180.png
Type: image/png
Size: 321 bytes
Desc: image922180.png
URL: <http://shibboleth.net/pipermail/users/attachments/20240413/a466c8de/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image551170.png
Type: image/png
Size: 570 bytes
Desc: image551170.png
URL: <http://shibboleth.net/pipermail/users/attachments/20240413/a466c8de/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image045362.png
Type: image/png
Size: 300 bytes
Desc: image045362.png
URL: <http://shibboleth.net/pipermail/users/attachments/20240413/a466c8de/attachment-0005.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image200907.png
Type: image/png
Size: 273 bytes
Desc: image200907.png
URL: <http://shibboleth.net/pipermail/users/attachments/20240413/a466c8de/attachment-0006.png>