[WFCORE-7192] Add brute force mitigation to the Elytron security realms. #721
Conversation
| * HTTP Programmatic | ||
|
|
||
| The wrapper will be applied automatically by the `elytron` subsystem, it will be possible to override the | ||
| default behaviour by setting the following realm specific system properties: |
There was a problem hiding this comment.
Would it be useful to have also global settings for all security realms to be configurable at once? (E.g. just by omitting [REALM NAME].)
There was a problem hiding this comment.
@OndrejKotek I have been thinking about this and IMO we should not add a global option.
The system property approach we are taking here is a short term configuration option until we are ready to add management attributes to configure this - once we add those attributes they will be on a realm by realm basis so we will not have a global equivalent.
We could consider a global management option but we don't really do that for other resources so I think I would prefer to keep per realm unless we receive end user requests for a global config option.
| a defined period of time after a defined number of failed authentication attempts. The failed authentication | ||
| attempts will be tracked in an in-memory cache. | ||
|
|
||
| The utility will be enabled by default for the following security realms: |
There was a problem hiding this comment.
How are we going to handle realms referencing these basic security realm? (For example failover-realm, distributed-realm, aggregate-realm.) Will it be possible to apply the configuration properties also to those? If so, which configuration would have precedence? Or will those security realms rather only let the protection on the wrapped realms?
There was a problem hiding this comment.
I am adding a clarification to the analysis but IMO we should not apply it to these realms so we don't need to worry about precendence and instead will apply it just to the realm that actually handles the raw identities.
github-actions
bot
added
stability-level/default
2 participants
https://issues.redhat.com/browse/WFCORE-7192