<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<div class="">Hey Stian,</div>
<div class=""><br class="">
</div>
<div class="">I agree that we could make something work with a Firewall / intrusion detection system if it’s decided that this is too complex to add directly to Keycloak.</div>
<div class=""><br class="">
</div>
<div class="">What I had in mind was a configurable sliding-time window rate limit that would prevent a client from making too many requests for a particular user in short time frames. E.g. limit each client to making at most 1 login request within a sliding
5 sec interval for each user. The 5 sec timespan could be made configurable or even be computed relative to the token timeout settings.</div>
<div class=""><br class="">
</div>
<div class="">Perhaps another alternative is to offer an admin alert to ensure that Keycloak admins are aware of clients that are incorrectly using/abusing the authentication workflow. I guess it could work the same way as the blocking rate limit, with the
exception of the fact that it would just send an email to the Keycloak admin instead of directly blocking the offending client.</div>
<div class=""><br class="">
</div>
<div class="">The OOM was indeed our fault as we were not using the paging options, I just mentioned it to provide additional context for the scenario that we experienced and to explain the reason that we had some down-time based upon these excessive logins.</div>
<div class=""><br class="">
</div>
<div class="">All that said, perhaps you’re right about the fact that this may be better handled in logic external to Keycloak. In any case, I think its a worthwhile discussion and appreciate your input!</div>
<div class=""><br class="">
</div>
<div class="">Thanks,</div>
<br class="">
<div apple-content-edited="true" class="">
<div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<div style="orphans: auto; text-align: start; text-indent: 0px; widows: auto; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<div style="orphans: auto; text-align: start; text-indent: 0px; widows: auto; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<div style="color: rgb(0, 0, 0); letter-spacing: normal; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; font-family: Arial, Helvetica, sans-serif; font-size: 13px;" class="">
<div style="box-sizing: border-box; margin: 0in 0in 0pt; color: rgba(0, 0, 0, 0.870588); widows: 1; font-size: 10pt; line-height: 14px; font-family: Arial, sans-serif; background-color: rgb(255, 255, 255);" class="">
<div style="box-sizing: border-box; margin: 0in 0in 0pt; font-size: 10pt; line-height: 14px;" class="">
Cory Snyder</div>
</div>
</div>
</div>
</div>
</div>
</div>
<br class="Apple-interchange-newline">
</div>
<br class="">
<div>
<blockquote type="cite" class="">
<div class="">On Sep 5, 2016, at 2:42 AM, Stian Thorgersen <<a href="mailto:sthorger@redhat.com" class="">sthorger@redhat.com</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div dir="ltr" class="">
<div class="">The brute force protection is there only to prevent guessing the password through a brute force attack. It's not there to stop DOS attacks. We don't have any rate limiting at the moment and I believe that's something that would be better introduced
with a firewall / intrusion detection system.<br class="">
</div>
<div class=""><br class="">
</div>
<div class="">It's non-trivial to add, especially with the fact that a single client that invokes the direct grant login could have thousands of legitimate users. I don't think a simple implementation would be much value and not replace a full fledged firewall.<br class="">
</div>
<div class=""><br class="">
</div>
<div class="">What did you have in mind with regards to requirements? Ability to configure max number of requests per-client? Per-user?</div>
<div class=""><br class="">
</div>
<div class="">For the OOM the events endpoints supports pagination as well as date ranges which should prevent and OOM issue when querying it.</div>
</div>
<div class="gmail_extra"><br class="">
<div class="gmail_quote">On 2 September 2016 at 15:44, Cory Snyder <span dir="ltr" class="">
<<a href="mailto:csnyder@iland.com" target="_blank" class="">csnyder@iland.com</a>></span> wrote:<br class="">
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word" class="">
<div class="">Hey guys,</div>
<div class=""><br class="">
</div>
<div class="">We ran into an issue recently where a customer didn’t have a great understanding of the OAuth2 authorization process and was submitting many direct grant login requests per second. They were successfully authenticating each time, so the brute
force protection features don’t apply. It basically ended up being a DOS issue. We also ended up having OOM issues when trying to query the events for this customer during a scheduled job that we use to build reports on login events. We’re still running 1.8.2
at the moment, so I’m wondering if you guys have implemented any kind of rate limiting / DOS prevention that could have prevented this in one of the later releases? If not, I'm proposing that it might be worth considering, I could try to contribute something
if you like. What do you guys think?</div>
<div class=""><br class="">
</div>
<div class="">Thanks,</div>
<br class="">
<div class="">
<div style="letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; word-wrap: break-word;" class="">
<div style="letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; word-wrap: break-word;" class="">
<div style="text-align:start;text-indent:0px;word-wrap:break-word" class="">
<div style="text-align:start;text-indent:0px;word-wrap:break-word" class="">
<div style="letter-spacing: normal; text-transform: none; white-space: normal; word-spacing: 0px; font-family: Arial, Helvetica, sans-serif; font-size: 13px;" class="">
<div style="margin: 0in 0in 0pt; font-size: 10pt; line-height: 14px; font-family: Arial, sans-serif; background-color: rgb(255, 255, 255);" class="">
<div style="margin:0in 0in 0pt;font-size:10pt;line-height:14px" class="">Cory Snyder</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<br class="">
</div>
<br class="">
______________________________<wbr class="">_________________<br class="">
keycloak-dev mailing list<br class="">
<a href="mailto:keycloak-dev@lists.jboss.org" class="">keycloak-dev@lists.jboss.org</a><br class="">
<a href="https://lists.jboss.org/mailman/listinfo/keycloak-dev" rel="noreferrer" target="_blank" class="">https://lists.jboss.org/<wbr class="">mailman/listinfo/keycloak-dev</a><br class="">
</blockquote>
</div>
<br class="">
</div>
</div>
</blockquote>
</div>
<br class="">
</body>
</html>