Package net.shibboleth.idp.authn.impl

Class StorageBackedAccountLockoutManager

  • All Implemented Interfaces:
    net.shibboleth.idp.authn.AccountLockoutManager, net.shibboleth.utilities.java.support.component.Component, net.shibboleth.utilities.java.support.component.DestructableComponent, net.shibboleth.utilities.java.support.component.IdentifiableComponent, net.shibboleth.utilities.java.support.component.IdentifiedComponent, net.shibboleth.utilities.java.support.component.InitializableComponent
    public class StorageBackedAccountLockoutManager
extends net.shibboleth.utilities.java.support.component.AbstractIdentifiableInitializableComponent
implements net.shibboleth.idp.authn.AccountLockoutManager
    Implementation of AccountLockoutManager interface that relies on a StorageService to track lockout state.

    • Field Detail

      • log

        @Nonnull
private org.slf4j.Logger log
        Class logger.

      • storageService

        @NonnullAfterInit
private org.opensaml.storage.StorageService storageService
        Backing service.

      • lockoutKeyStrategy

        @Nullable
private Function<org.opensaml.profile.context.ProfileRequestContext,​String> lockoutKeyStrategy
        Lookup function to produce account lockout keys.

      • maxAttemptsLookupStrategy

        @Nonnull
private Function<org.opensaml.profile.context.ProfileRequestContext,​Integer> maxAttemptsLookupStrategy
        Lookup function for maximum failed attempts within window.

      • counterIntervalLookupStrategy

        @Nonnull
private Function<org.opensaml.profile.context.ProfileRequestContext,​Duration> counterIntervalLookupStrategy
        Lookup function for interval after which counter is reset.

      • lockoutDurationLookupStrategy

        @Nonnull
private Function<org.opensaml.profile.context.ProfileRequestContext,​Duration> lockoutDurationLookupStrategy
        Lookup function for duration of lockout.

      • extendLockoutDuration

        private boolean extendLockoutDuration
        Controls whether attempts against locked accounts extend duration.

    • Constructor Detail

      • StorageBackedAccountLockoutManager

        public StorageBackedAccountLockoutManager()
        Constructor.

    • Method Detail

      • setStorageService

        public void setStorageService​(@Nonnull
                              org.opensaml.storage.StorageService storage)
        Set the StorageService back-end to use.
        Parameters:
        storage - the back-end to use

      • setLockoutKeyStrategy

        public void setLockoutKeyStrategy​(@Nonnull
                                  Function<org.opensaml.profile.context.ProfileRequestContext,​String> strategy)
        Set the strategy function to compute the account lockout key.

        Defaults to a concatenation of the username and client address.

        Parameters:
        strategy - strategy function

      • setMaxAttempts

        public void setMaxAttempts​(@Positive
                           int attempts)
        Set the maximum failed attempts within window.

        Defaults to 5.

        Parameters:
        attempts - maximum failed attempts

      • setMaxAttemptsLookupStrategy

        public void setMaxAttemptsLookupStrategy​(@Nonnull
                                         Function<org.opensaml.profile.context.ProfileRequestContext,​Integer> strategy)
        Set lookup function for maximum failed attempts within window.

        The function MUST return a positive value.

        Parameters:
        strategy - lookup function

      • setCounterInterval

        public void setCounterInterval​(@Nonnull
                               Duration window)
        Set interval after which counter is reset.

        Defaults to 5 minutes.

        Parameters:
        window - counter window

      • setCounterIntervalLookupStrategy

        public void setCounterIntervalLookupStrategy​(@Nonnull
                                             Function<org.opensaml.profile.context.ProfileRequestContext,​Duration> strategy)
        Set lookup function for interval after which counter is reset.

        The function MUST return a positive value.

        Parameters:
        strategy - lookup function

      • setLockoutDuration

        public void setLockoutDuration​(@Nonnull
                               Duration duration)
        Set lockout duration.

        Defaults to 5 minutes.

        Parameters:
        duration - lockout duration

      • setLockoutDurationLookupStrategy

        public void setLockoutDurationLookupStrategy​(@Nonnull
                                             Function<org.opensaml.profile.context.ProfileRequestContext,​Duration> strategy)
        Set lookup function for lockout duration.

        The function MUST return a positive value. Use a large value for permanent lockout.

        Parameters:
        strategy - lookup function

      • setExtendLockoutDuration

        public void setExtendLockoutDuration​(boolean flag)
        Set whether to extend the lockout duration on attempts during lockout.
        Parameters:
        flag - flag to set

      • doInitialize

        protected void doInitialize()
                     throws net.shibboleth.utilities.java.support.component.ComponentInitializationException
        Overrides:
        doInitialize in class net.shibboleth.utilities.java.support.component.AbstractIdentifiedInitializableComponent
        Throws:
        net.shibboleth.utilities.java.support.component.ComponentInitializationException

      • check

        public boolean check​(@Nonnull
                     org.opensaml.profile.context.ProfileRequestContext profileRequestContext)
        Specified by:
        check in interface net.shibboleth.idp.authn.AccountLockoutManager

      • increment

        public boolean increment​(@Nonnull
                         org.opensaml.profile.context.ProfileRequestContext profileRequestContext)
        Specified by:
        increment in interface net.shibboleth.idp.authn.AccountLockoutManager

      • clear

        public boolean clear​(@Nonnull
                     org.opensaml.profile.context.ProfileRequestContext profileRequestContext)
        Specified by:
        clear in interface net.shibboleth.idp.authn.AccountLockoutManager

      • doIncrement

        protected boolean doIncrement​(@Nonnull
                              org.opensaml.profile.context.ProfileRequestContext profileRequestContext,
                              @Nonnull @NotEmpty
                              String key,
                              int retries)
        Implement invalid login attempt counter via storage service, retrying as necessary.
        Parameters:
        profileRequestContext - current profile request context
        key - account lockout key
        retries - number of additional retries to allow
        Returns:
        true iff successful