libre.sh/keycloak-scim
3
0
Fork 0
Code Issues 15 Pull requests Releases 1 Packages Activity Actions

Invalidate authentication session on repeated OTP failures

Browse source 
Closes #26177
Signed-off-by: Douglas Palmer <dpalmer@redhat.com>
This commit is contained in:
Douglas Palmer 2024-01-13 09:35:54 -08:00 committed by Pedro Igor
parent 972d198c45
commit 18d0105de0
2 changed files with 9 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
services/src/main/java/org/keycloak/authentication/authenticators/browser/OTPFormAuthenticator.java
View file

@ -35,6 +35,7 @@ import org.keycloak.models.RealmModel;
import org.keycloak.models.UserCredentialModel;
import org.keycloak.models.UserModel;
import org.keycloak.models.credential.OTPCredentialModel;
import org.keycloak.services.managers.AuthenticationSessionManager;
import org.keycloak.services.messages.Messages;
import org.keycloak.services.validation.Validation;
import org.keycloak.sessions.AuthenticationSessionModel;
@ -89,6 +90,7 @@ public class OTPFormAuthenticator extends AbstractUsernameFormAuthenticator impl
UserModel userModel = context.getUser();
if (!enabledUser(context, userModel)) {
// error in context is set in enabledUser/isDisabledByBruteForce
new AuthenticationSessionManager(context.getSession()).removeAuthenticationSession(context.getRealm(), context.getAuthenticationSession(), true);
return;
}

16
testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/BruteForceTest.java
View file

@ -455,9 +455,6 @@ public class BruteForceTest extends AbstractTestRealmKeycloakTest {
loginInvalidPassword();
loginWithTotpFailure();
continueLoginWithCorrectTotpExpectFailure();
continueLoginWithInvalidTotp();
clearUserFailures();
continueLoginWithTotp();
}
@Test
@ -466,13 +463,14 @@ public class BruteForceTest extends AbstractTestRealmKeycloakTest {
loginWithMissingTotp();
loginWithMissingTotp();
continueLoginWithMissingTotp();
continueLoginWithCorrectTotpExpectFailure();
// wait to unlock
testingClient.testing().setTimeOffset(Collections.singletonMap("offset", String.valueOf(6)));
}
continueLoginWithTotp();
testingClient.testing().setTimeOffset(Collections.singletonMap("offset", String.valueOf(0)));
@Test
public void testBrowserTotpSessionClosedAfterLockout() throws Exception {
long start = System.currentTimeMillis();
loginWithTotpFailure();
continueLoginWithInvalidTotp();
loginPage.assertCurrent();
}
@Test