CAS 6.0.5 : Throttling

[Alfonso Vera]

Hi folks

I 'm trying to get authentication throttling to work

We read  the doc: 

• failureRangeInSeconds: Period of time in seconds during which the threshold applies.
• failureThreshold: Number of failed login attempts permitted in the above period.

but second attempt always triggers 'access denied'  like: https://groups.google.com/a/apereo.org/d/msg/cas-user/EkS2Jg06Vgo/JbxeLNVnAQAJ

Later we readed: https://groups.google.com/a/apereo.org/d/msg/cas-user/EkS2Jg06Vgo/JbxeLNVnAQAJ  "secondsBetweenConsecutiveFailures"

and 

https://github.com/apereo/cas/blob/master/support/cas-server-support-throttle-core/src/main/java/org/apereo/cas/web/support/AbstractThrottledSubmissionHandlerInterceptorAdapter.java

cas.authn.throttle.usernameParameter=username
cas.authn.throttle.schedule.startDelay=PT10S
cas.authn.throttle.schedule.repeatInterval=PT20S
cas.authn.throttle.appCode=CAS

cas.authn.throttle.failure.threshold=1000
cas.authn.throttle.failure.code=AUTHENTICATION_FAILED
cas.authn.throttle.failure.rangeSeconds=60

I'm confusing,  Really how does it work? 

I can't find the meaning of 

cas.authn.throttle.schedule.startDelay=PT10S
cas.authn.throttle.schedule.repeatInterval=PT20S

Any kind of help will be appreciated

[Ray Bon]

Alfonso,

Your configuration and investigation show that throttling is a ratio.

Threshold is number of attempts during the range. With threshold being greater than range, anything more than one attempt will fail.

Try 1 attempt in 5 seconds (or however long it takes a human to retype a password).

threshold=1

rangeSeconds=5

If user types bad username/password more than once in 5 seconds, throttle.

Ray

-- 

Ray Bon

Programmer Analyst

Development Services, University Systems

2507218831 | CLE 019 | rb...@uvic.ca

I respectfully acknowledge that my place of work is located within the ancestral, traditional and unceded territory of the Songhees, Esquimalt and WSÁNEĆ Nations.

[Alfonso " Bersuit" Vera]

Hi Ray 

Thanks for the help

Sorry for the inconvenience , How does throttle schedule work?

cas.authn.throttle.schedule.startDelay=PT10S

cas.authn.throttle.schedule.repeatInterval=PT20S

--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+u...@apereo.org.
To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/cb3ea3580b3a504c5d40d7e18ef203164fce048b.camel%40uvic.ca.

--

----------------------
Alfonso "Bersuit" Vera
http://about.me/alfonso.vera

[Christian Schmidt]

Have a look at https://github.com/apereo/cas/blob/master/support/cas-server-support-throttle-core/src/main/java/org/apereo/cas/web/support/InMemoryThrottledSubmissionCleaner.java but it won't lead you anywhere.

I agree with you in that point, that the documentation regarding the threshold and range is silly.

The real implementation that uses a factor instead of those 2 values is something totally different.

[Albert Cabello Sanchez]

In my experience, what the doc says is not true.

You can configure 3 tries in 30 seconds, but the actual threshold will be
one try in 10 seconds.

Regards.

----- Original Message -----

Hi folks

I 'm trying to get authentication throttling to work

We read the doc:

- failureRangeInSeconds: Period of time in seconds during which the
threshold applies.
- failureThreshold: Number of failed login attempts permitted in the
above period.


--
Alberto Cabello Sánchez
Universidad de Extremadura

[Patrick Proniewski]

The threshold is actually a ratio. 3 tries in 30 seconds is 0.1 try per second, so if you fail more than 0.1 per second you get throttled. Fail twice in 5 seconds (0.4 ratio) and you're throttled.

> --
> - Website: https://apereo.github.io/cas
> - Gitter Chatroom: https://gitter.im/apereo/cas
> - List Guidelines: https://goo.gl/1VRrw7
> - Contributions: https://goo.gl/mh7qDG
> ---
> You received this message because you are subscribed to the Google Groups "CAS Community" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+u...@apereo.org.

> To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/1265644659.376934.1569499982071.JavaMail.zimbra%40unex.es.

Patrick PRONIEWSKI
--
Chef du Service Opérations - DSI - Université Lumière Lyon 2
Responsable Sécurité des Systèmes d'Information