<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">I think it’s the responsibility of the UserFederationProvider to decide if a password is valid or not. Therefore, even empty passwords have to be send to it.<div class=""><div apple-content-edited="true" class=""><br class="Apple-interchange-newline">
</div>
<br class=""><div><blockquote type="cite" class=""><div class="">On 23.11.2015, at 09:04, Stian Thorgersen <<a href="mailto:sthorger@redhat.com" class="">sthorger@redhat.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class="">Question: a user passing an empty password is that really a brute force attempt? Is it not more likely that a user has forgotten to enter the password? I'm asking because I'm not convinced forgetting to enter a value in the password field should count as a login attempt.</div><div class="gmail_extra"><br class=""><div class="gmail_quote">On 23 November 2015 at 09:02, Marek Posolda <span dir="ltr" class=""><<a href="mailto:mposolda@redhat.com" target="_blank" class="">mposolda@redhat.com</a>></span> wrote:<br class=""><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Sure, that would be fine. But again, it's important that with default<br class="">
settings, LDAPOperationManager.authenticate won't automatically<br class="">
authenticate AD users with empty password (which may happen when<br class="">
anonymous bind is enabled on AD side).<br class="">
<span class="HOEnZb"><font color="#888888" class=""><br class="">
Marek<br class="">
</font></span><div class="HOEnZb"><div class="h5"><br class="">
On 20/11/15 18:22, Michael Gerber wrote:<br class="">
> We’ve got a custom UserFederationProvider, which authenticate users against an AD or DB. Therefore, we need to know if a user entered an empty password.<br class="">
> I will create a PR and jira ticket for that, ok?<br class="">
><br class="">
>> On 20.11.2015, at 17:50, Marek Posolda <<a href="mailto:mposolda@redhat.com" class="">mposolda@redhat.com</a>> wrote:<br class="">
>><br class="">
>> That will be the easiest path to use our BruteForceProtector.<br class="">
>><br class="">
>> However AD also has some "BruteForceProtector" of it's own, which disables user in AD when he reach some count of invalid attempts. And I guess Michael wants to use that one and disable user in AD as well.<br class="">
>><br class="">
>> Marek<br class="">
>><br class="">
>> On 20/11/15 17:40, Bill Burke wrote:<br class="">
>>> You can I guess, but why does it matter? invalidPassword hits the brute<br class="">
>>> force detector if it is turned on.<br class="">
>>><br class="">
>>> On 11/20/2015 10:16 AM, Michael Gerber wrote:<br class="">
>>>> AbstractUsernameFormAuthenticator.validatePassword<br class="">
>>>><br class="">
>>>> public boolean validatePassword(AuthenticationFlowContext context, UserModel user, MultivaluedMap<String, String> inputData) {<br class="">
>>>> List<UserCredentialModel> credentials =new LinkedList<>();<br class="">
>>>> String password = inputData.getFirst(CredentialRepresentation.PASSWORD);<br class="">
>>>> if (password ==null || password.isEmpty()) {<br class="">
>>>> invalidPassword(context, user);<br class="">
>>>> return false;<br class="">
>>>> }<br class="">
>>>> credentials.add(UserCredentialModel.password(password));<br class="">
>>>> boolean valid = context.getSession().users().validCredentials(context.getRealm(), user, credentials);<br class="">
>>>> if (!valid) {<br class="">
>>>> invalidPassword(context, user);<br class="">
>>>> return false;<br class="">
>>>> }<br class="">
>>>> return true;<br class="">
>>>> }<br class="">
>>>><br class="">
>>>> I think we can remove the first if (password == null || password.isEmpty())<br class="">
>>>><br class="">
>>>> Am 20. November 2015 um 16:11 schrieb Bill Burke <<a href="mailto:bburke@redhat.com" class="">bburke@redhat.com</a>>:<br class="">
>>>><br class="">
>>>>> Point me to the code?<br class="">
>>>>><br class="">
>>>>> On 11/20/2015 9:04 AM, Michael Gerber wrote:<br class="">
>>>>>> Hi All,<br class="">
>>>>>><br class="">
>>>>>> keycloak does not pass an empty password to the validCredentials method<br class="">
>>>>>> in the UserFederationProvider class.<br class="">
>>>>>> Is there a reason for that? I would like to authenticate against an AD<br class="">
>>>>>> even if the password is empty, otherwise the user won't be blocked after<br class="">
>>>>>> x attempts.<br class="">
>>>>>><br class="">
>>>>>> Michael<br class="">
>>>>>><br class="">
>>>>>><br class="">
>>>>>> _______________________________________________<br class="">
>>>>>> keycloak-dev mailing list<br class="">
>>>>>> <a href="mailto:keycloak-dev@lists.jboss.org" class="">keycloak-dev@lists.jboss.org</a> <mailto:<a href="mailto:keycloak-dev@lists.jboss.org" class="">keycloak-dev@lists.jboss.org</a>><br class="">
>>>>>> <a href="https://lists.jboss.org/mailman/listinfo/keycloak-dev" rel="noreferrer" target="_blank" class="">https://lists.jboss.org/mailman/listinfo/keycloak-dev</a><br class="">
>>>>>><br class="">
>>>>> --<br class="">
>>>>> Bill Burke<br class="">
>>>>> JBoss, a division of Red Hat<br class="">
>>>>> <a href="http://bill.burkecentral.com/" rel="noreferrer" target="_blank" class="">http://bill.burkecentral.com</a><br class="">
>>>>> _______________________________________________<br class="">
>>>>> keycloak-dev mailing list<br class="">
>>>>> <a href="mailto:keycloak-dev@lists.jboss.org" class="">keycloak-dev@lists.jboss.org</a> <mailto:<a href="mailto:keycloak-dev@lists.jboss.org" class="">keycloak-dev@lists.jboss.org</a>><br class="">
>>>>> <a href="https://lists.jboss.org/mailman/listinfo/keycloak-dev" rel="noreferrer" target="_blank" class="">https://lists.jboss.org/mailman/listinfo/keycloak-dev</a><br class="">
<br class="">
_______________________________________________<br class="">
keycloak-dev mailing list<br class="">
<a href="mailto:keycloak-dev@lists.jboss.org" class="">keycloak-dev@lists.jboss.org</a><br class="">
<a href="https://lists.jboss.org/mailman/listinfo/keycloak-dev" rel="noreferrer" target="_blank" class="">https://lists.jboss.org/mailman/listinfo/keycloak-dev</a><br class="">
</div></div></blockquote></div><br class=""></div>
</div></blockquote></div><br class=""></div></body></html>