<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;"><pre><div>The question of Mara was perfectly legitimated and the answers are not really acceptable.</div></pre><pre>I have the opinion that the number of failures needs to be persisted and the designer should not make assumption about the times and periods for server restarts</pre><pre>Secondly, where should be such a brute detection implemented if not in Keycloak?</pre><pre>In effect is is implemented, but the implementation can be made better.</pre><pre>FYI information we implemented it using the functionalities of the LDAP server.</pre><pre><br></pre><pre>Regards,</pre><pre>Giovanni</pre><pre><br></pre><pre><br></pre><pre>>>In addition, is pretty much possible to configure fail2ban to read the
>>log files and store it into the database for example
>>(<a href="http://www.fail2ban.org/wiki/index.php/Commands#DATABASE">http://www.fail2ban.org/wiki/index.php/Commands#DATABASE</a>).
>>
>>I can be wrong, but I don't think Keycloak should have something like this.
>>
On Fri, Dec 4, 2015 at 5:26 PM, Stan Silvert <<a href="https://lists.jboss.org/mailman/listinfo/keycloak-user">ssilvert at redhat.com</a>> wrote:
><i> On 12/4/2015 12:15 PM, Notarnicola, Mara wrote:
</i>><i>
</i>><i> Dear all,
</i>><i>
</i>><i> I have enabled brute force detection on my keycloak application server.
</i>><i>
</i>><i> I used keycloak 1.5.0 Final version.
</i>><i>
</i>><i> After several trials I saw that the number of failures of the users are
</i>><i> saved in session, so if the server will be restarted the counter starts from
</i>><i> 0 again.
</i>><i>
</i>><i> Why you don’t save it into db?
</i>><i>
</i>><i> I didn't design this, but I think it's because brute force detection is
</i>><i> designed to thwart guessing of credentials over a relatively short time
</i>><i> period. In production you don't restart the server very often.
</i>><i>
</i>><i>
</i>><i>
</i>><i> Mara
</i>><i>
</i>><i>
</i>><i>
</i>><i> _______</i></pre></body></html>