No defense against brute force attacks [enhancement idea]

[daniel-frak]

No defense against brute force attacks [enhancement idea]

[xgp]

Doesn't this mean that Keycloak doesn't have brute force protection against user registration, and so you can still overwhelm it by registering users, even without a migration plugin?

It's not meant to be generalized protection against all kinds of attacks. They specifically define a "brute force attack" as an attempt to guess a user’s password by trying to log in multiple times. Keycloak has brute force detection capabilities for this specific type of attack, and can temporarily disable a user account if the number of login failures exceeds a specified threshold.

If not, and this is truly something that the plugin should handle, then I'd be happy to accept a PR for this :)

Because this extension allows testing of a user's password using multiple login attempts, but does not mitigate using Keycloak's mechanism, it would need it's own mechanism of counting and disabling attempts in order to match the expected functionality of Keycloak.

Unfortunately, I don't think I'll have the time to implement this myself.

No problem. I think we can implement this, so if you wouldn't mind keeping it open, I'll see when when have some time to do this.

[xgp]

One thing to note in a potential implementation is that the InfinispanUserLoginFailureProvider which is the default implementation that is returned from session.loginFailures() doesn't seem to care about the format of the userId parameters that are passed in. An experiment that might make an implementation quite a bit easier would be to pass the email/username as the userId to see if it works. Then you get an implementation for "free".

[daniel-frak]

Doesn't this mean that Keycloak doesn't have brute force protection against user registration, and so you can still overwhelm it by registering users, even without a migration plugin?

If not, and this is truly something that the plugin should handle, then I'd be happy to accept a PR for this :)

Unfortunately, I don't think I'll have the time to implement this myself.