<div dir="ltr">Question: a user passing an empty password is that really a brute force attempt? Is it not more likely that a user has forgotten to enter the password? I'm asking because I'm not convinced forgetting to enter a value in the password field should count as a login attempt.</div><div class="gmail_extra"><br><div class="gmail_quote">On 23 November 2015 at 09:02, Marek Posolda <span dir="ltr"><<a href="mailto:mposolda@redhat.com" target="_blank">mposolda@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Sure, that would be fine. But again, it's important that with default<br>
settings, LDAPOperationManager.authenticate won't automatically<br>
authenticate AD users with empty password (which may happen when<br>
anonymous bind is enabled on AD side).<br>
<span class="HOEnZb"><font color="#888888"><br>
Marek<br>
</font></span><div class="HOEnZb"><div class="h5"><br>
On 20/11/15 18:22, Michael Gerber wrote:<br>
> We’ve got a custom UserFederationProvider, which authenticate users against an AD or DB. Therefore, we need to know if a user entered an empty password.<br>
> I will create a PR and jira ticket for that, ok?<br>
><br>
>> On 20.11.2015, at 17:50, Marek Posolda <<a href="mailto:mposolda@redhat.com">mposolda@redhat.com</a>> wrote:<br>
>><br>
>> That will be the easiest path to use our BruteForceProtector.<br>
>><br>
>> However AD also has some "BruteForceProtector" of it's own, which disables user in AD when he reach some count of invalid attempts. And I guess Michael wants to use that one and disable user in AD as well.<br>
>><br>
>> Marek<br>
>><br>
>> On 20/11/15 17:40, Bill Burke wrote:<br>
>>> You can I guess, but why does it matter? invalidPassword hits the brute<br>
>>> force detector if it is turned on.<br>
>>><br>
>>> On 11/20/2015 10:16 AM, Michael Gerber wrote:<br>
>>>> AbstractUsernameFormAuthenticator.validatePassword<br>
>>>><br>
>>>> public boolean validatePassword(AuthenticationFlowContext context, UserModel user, MultivaluedMap<String, String> inputData) {<br>
>>>> List<UserCredentialModel> credentials =new LinkedList<>();<br>
>>>> String password = inputData.getFirst(CredentialRepresentation.PASSWORD);<br>
>>>> if (password ==null || password.isEmpty()) {<br>
>>>> invalidPassword(context, user);<br>
>>>> return false;<br>
>>>> }<br>
>>>> credentials.add(UserCredentialModel.password(password));<br>
>>>> boolean valid = context.getSession().users().validCredentials(context.getRealm(), user, credentials);<br>
>>>> if (!valid) {<br>
>>>> invalidPassword(context, user);<br>
>>>> return false;<br>
>>>> }<br>
>>>> return true;<br>
>>>> }<br>
>>>><br>
>>>> I think we can remove the first if (password == null || password.isEmpty())<br>
>>>><br>
>>>> Am 20. November 2015 um 16:11 schrieb Bill Burke <<a href="mailto:bburke@redhat.com">bburke@redhat.com</a>>:<br>
>>>><br>
>>>>> Point me to the code?<br>
>>>>><br>
>>>>> On 11/20/2015 9:04 AM, Michael Gerber wrote:<br>
>>>>>> Hi All,<br>
>>>>>><br>
>>>>>> keycloak does not pass an empty password to the validCredentials method<br>
>>>>>> in the UserFederationProvider class.<br>
>>>>>> Is there a reason for that? I would like to authenticate against an AD<br>
>>>>>> even if the password is empty, otherwise the user won't be blocked after<br>
>>>>>> x attempts.<br>
>>>>>><br>
>>>>>> Michael<br>
>>>>>><br>
>>>>>><br>
>>>>>> _______________________________________________<br>
>>>>>> keycloak-dev mailing list<br>
>>>>>> <a href="mailto:keycloak-dev@lists.jboss.org">keycloak-dev@lists.jboss.org</a> <mailto:<a href="mailto:keycloak-dev@lists.jboss.org">keycloak-dev@lists.jboss.org</a>><br>
>>>>>> <a href="https://lists.jboss.org/mailman/listinfo/keycloak-dev" rel="noreferrer" target="_blank">https://lists.jboss.org/mailman/listinfo/keycloak-dev</a><br>
>>>>>><br>
>>>>> --<br>
>>>>> Bill Burke<br>
>>>>> JBoss, a division of Red Hat<br>
>>>>> <a href="http://bill.burkecentral.com" rel="noreferrer" target="_blank">http://bill.burkecentral.com</a><br>
>>>>> _______________________________________________<br>
>>>>> keycloak-dev mailing list<br>
>>>>> <a href="mailto:keycloak-dev@lists.jboss.org">keycloak-dev@lists.jboss.org</a> <mailto:<a href="mailto:keycloak-dev@lists.jboss.org">keycloak-dev@lists.jboss.org</a>><br>
>>>>> <a href="https://lists.jboss.org/mailman/listinfo/keycloak-dev" rel="noreferrer" target="_blank">https://lists.jboss.org/mailman/listinfo/keycloak-dev</a><br>
<br>
_______________________________________________<br>
keycloak-dev mailing list<br>
<a href="mailto:keycloak-dev@lists.jboss.org">keycloak-dev@lists.jboss.org</a><br>
<a href="https://lists.jboss.org/mailman/listinfo/keycloak-dev" rel="noreferrer" target="_blank">https://lists.jboss.org/mailman/listinfo/keycloak-dev</a><br>
</div></div></blockquote></div><br></div>