This repository is no longer maintained. It has been included directly in https://github.com/silinternational/ssp-base.
--
SimpleSAMLphp auth module implementing custom business logic
To create another database migration file, run the following (replacing
YourMigrationName
with whatever you want the migration to be named, using
CamelCase):
make migration NAME=YourMigrationName
SilAuth will rate limit failed logins by username and by every untrusted IP address from a login attempt.
If there have been more than 10 failed logins for a given username (or IP address) within the past hour, a captcha will be included in the webpage. The user may or may not have to directly interact with the captcha, though.
If there have been more than 50 failed logins for that username (or IP address) within the past hour, logins for that username (or IP address) will be blocked for up to an hour.
For each login attempt, if it has too many failed logins within the last hour (aka. recent failed logins) for the given username OR for any single untrusted IP address associated with the current request, it will do one of the following:
Authenticator::REQUIRE_CAPTCHA_AFTER_NTH_FAILED_LOGIN
recent failures: process the request normally.Authenticator::BLOCK_AFTER_NTH_FAILED_LOGIN
: require the user to pass a
captcha.(recent failures above the limit)^2
seconds after the most recent failed login, with a
minimum of 3 (so blocking for 9 seconds).See features/login.feature
for descriptions of how various situations are
handled. That file not only contains human-readable scenarios, but those are
also actual tests that are run to ensure those descriptions are correct.
BLOCK_AFTER_NTH_FAILED_LOGIN
is 50, andREQUIRE_CAPTCHA_AFTER_NTH_FAILED_LOGIN
is 10, andjohn_smith
, and11.22.33.44
, and192.168.1.2
, andjohn_smith
from 192.168.1.2
and their request
goes through a proxy at 11.22.33.44
, then11.22.33.44
, thenSince this application enforces rate limits based on the number of recent
failed login attempts by both username and IP address, and since it looks at
both the REMOTE_ADDR and the X-Forwarded-For header for IP addresses, you will
want to list any IP addresses that should NOT be rate limited (such as your
load balancer) in the TRUSTED_IP_ADDRESSES environment variable (see
local.env.dist
).
To check the status of the website, you can access this URL:
https://(your domain name)/module.php/silauth/status.php
To debug the project in your IDE (such as NetBeans), do the following:
local.env
file, insert your IP address as the value for
XDEBUG_REMOTE_HOST
.make start enabledebug
./etc/hosts
file for 127.0.0.1 silauth.local
make
Xdebug can be enabled by doing the following:
REMOTE_DEBUG_IP
in local.env
. This should be the IP address of your development machine, i.e. the one that
is running your IDE. If you're using Linux as your Docker host, you can use 172.17.0.1 here.volumes:
- ./development/run-debug.sh:/data/run.sh
In PhpStorm go to: Preferences > PHP > Debug > DBGp Proxy and set the following settings:
Set path mappings in: Preferences > PHP > Servers
Then start listening by clicking the "listen" button on the PhpStorm toolbar.