Package net.shibboleth.idp.authn.impl

# Class StorageBackedAccountLockoutManager

java.lang.Object
net.shibboleth.shared.component.AbstractInitializableComponent
net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent
net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent
net.shibboleth.idp.authn.impl.StorageBackedAccountLockoutManager

All Implemented Interfaces:
  `AccountLockoutManager`, `EnumeratableAccountLockoutManager`, `Component`, `DestructableComponent`, `IdentifiableComponent`, `IdentifiedComponent`, `InitializableComponent`

public class StorageBackedAccountLockoutManager extends AbstractIdentifiableInitializableComponent implements EnumeratableAccountLockoutManager
Implementation of `EnumeratableAccountLockoutManager` interface that relies on a `StorageService` to track lockout state.

## Nested Class Summary

Nested Classes
Modifier and Type
Class
Description
`static class`
`StorageBackedAccountLockoutManager.UsernameIPLockoutKeyStrategy`
A function to generate a key for lockout storage.

## Field Summary

Fields
Modifier and Type
Field
Description
`private Function<ProfileRequestContext,Duration>`
`counterIntervalLookupStrategy`
Lookup function for interval after which counter is reset.
`private boolean`
`extendLockoutDuration`
Controls whether attempts against locked accounts extend duration.
`private Function<ProfileRequestContext,Duration>`
`lockoutDurationLookupStrategy`
Lookup function for duration of lockout.
`private Function<ProfileRequestContext,String>`
`lockoutKeyStrategy`
Lookup function to produce account lockout keys.
`private org.slf4j.Logger`
`log`
Class logger.
`private Function<ProfileRequestContext,Integer>`
`maxAttemptsLookupStrategy`
Lookup function for maximum failed attempts within window.
`private StorageService`
`storageService`
Backing service.

## Constructor Summary

Constructors
Constructor
Description
`StorageBackedAccountLockoutManager()`
Constructor.

## Method Summary

Modifier and Type
Method
Description
`boolean`
`check(ProfileRequestContext profileRequestContext)`
Check if the authentication credentials associated with the request are subject to lockout.
`boolean`
`clear(ProfileRequestContext profileRequestContext)`
Clear the lockout state for the authentication credentials associated with the request.
`protected boolean`
`doCheck(ProfileRequestContext profileRequestContext, String key, int maxAttempts, long lockoutDuration, long counterInterval, boolean increment)`
Helper method to perform a check operation against a specific key.
`protected boolean`
`doIncrement(ProfileRequestContext profileRequestContext, String key, int retries, long lockoutDuration, long counterInterval)`
Implement invalid login attempt counter via storage service, retrying as necessary.
`protected void`
`doInitialize()`
`Iterable<String>`
`enumerate(ProfileRequestContext profileRequestContext)`
Return iterable collection of locked out keys that match a supplied partial key (i.e., are prefixed by it).
`private Function<ProfileRequestContext,String>`
`getLockoutKeyStrategy()`
Guaranteed non null value for `lockoutKeyStrategy`.
`boolean`
`increment(ProfileRequestContext profileRequestContext)`
Increment the lockout counter for the authentication credentials associated with the request.
`void`
`setCounterInterval(Duration window)`
Set interval after which counter is reset.
`void`
`setCounterIntervalLookupStrategy(Function<ProfileRequestContext,Duration> strategy)`
Set lookup function for interval after which counter is reset.
`void`
`setExtendLockoutDuration(boolean flag)`
Set whether to extend the lockout duration on attempts during lockout.
`void`
`setLockoutDuration(Duration duration)`
Set lockout duration.
`void`
`setLockoutDurationLookupStrategy(Function<ProfileRequestContext,Duration> strategy)`
Set lookup function for lockout duration.
`void`
`setLockoutKeyStrategy(Function<ProfileRequestContext,String> strategy)`
Set the strategy function to compute the account lockout key.
`void`
`setMaxAttempts(int attempts)`
Set the maximum failed attempts within window.
`void`
`setMaxAttemptsLookupStrategy(Function<ProfileRequestContext,Integer> strategy)`
Set lookup function for maximum failed attempts within window.
`void`
`setStorageService(StorageService storage)`
Set the `StorageService` back-end to use.

### Methods inherited from class net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent

`setId`

### Methods inherited from class net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent

`ensureId, getId, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException`

### Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

`checkComponentActive, checkSetterPreconditions, destroy, doDestroy, initialize, isDestroyed, isInitialized`

### Methods inherited from class java.lang.Object

`clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

### Methods inherited from interface net.shibboleth.shared.component.IdentifiedComponent

`getId`

## Field Details

### log

@Nonnull private org.slf4j.Logger log
Class logger.

### storageService

@NonnullAfterInit private StorageService storageService
Backing service.

### lockoutKeyStrategy

@Nullable private Function<ProfileRequestContext,String> lockoutKeyStrategy
Lookup function to produce account lockout keys.

### maxAttemptsLookupStrategy

@Nonnull private Function<ProfileRequestContext,Integer> maxAttemptsLookupStrategy
Lookup function for maximum failed attempts within window.

### counterIntervalLookupStrategy

@Nonnull private Function<ProfileRequestContext,Duration> counterIntervalLookupStrategy
Lookup function for interval after which counter is reset.

### lockoutDurationLookupStrategy

@NonnullAfterInit private Function<ProfileRequestContext,Duration> lockoutDurationLookupStrategy
Lookup function for duration of lockout.

### extendLockoutDuration

private boolean extendLockoutDuration
Controls whether attempts against locked accounts extend duration.

## Constructor Details

### StorageBackedAccountLockoutManager

public StorageBackedAccountLockoutManager()
Constructor.

## Method Details

### setStorageService

public void setStorageService(@Nonnull StorageService storage)
Set the `StorageService` back-end to use.

Parameters:
  `storage` - the back-end to use

### setLockoutKeyStrategy

public void setLockoutKeyStrategy(@Nonnull Function<ProfileRequestContext,String> strategy)
Set the strategy function to compute the account lockout key.

Defaults to a concatenation of the username and client address.

Parameters:
  `strategy` - strategy function

### setMaxAttempts

public void setMaxAttempts(@Positive int attempts)
Set the maximum failed attempts within window.

Defaults to 5.

Parameters:
  `attempts` - maximum failed attempts

### setMaxAttemptsLookupStrategy

public void setMaxAttemptsLookupStrategy(@Nonnull Function<ProfileRequestContext,Integer> strategy)
Set lookup function for maximum failed attempts within window.

The function MUST return a positive value.

Parameters:
  `strategy` - lookup function

### setCounterInterval

public void setCounterInterval(@Nonnull Duration window)
Set interval after which counter is reset.

Defaults to 5 minutes.

Parameters:
  `window` - counter window

### setCounterIntervalLookupStrategy

public void setCounterIntervalLookupStrategy(@Nonnull Function<ProfileRequestContext,Duration> strategy)
Set lookup function for interval after which counter is reset.

The function MUST return a positive value.

Parameters:
  `strategy` - lookup function

### setLockoutDuration

public void setLockoutDuration(@Nonnull Duration duration)
Set lockout duration.

Defaults to 5 minutes.

Parameters:
  `duration` - lockout duration

### setLockoutDurationLookupStrategy

public void setLockoutDurationLookupStrategy(@Nonnull Function<ProfileRequestContext,Duration> strategy)
Set lookup function for lockout duration.

The function MUST return a positive value. Use a large value for permanent lockout.

Parameters:
  `strategy` - lookup function

### setExtendLockoutDuration

public void setExtendLockoutDuration(boolean flag)
Set whether to extend the lockout duration on attempts during lockout.

Parameters:
  `flag` - flag to set

### doInitialize

protected void doInitialize() throws ComponentInitializationException

Overrides:
  `doInitialize` in class `AbstractIdentifiedInitializableComponent`
Throws:
  `ComponentInitializationException`

### getLockoutKeyStrategy

@Nonnull private Function<ProfileRequestContext,String> getLockoutKeyStrategy()
Guaranteed non null value for `lockoutKeyStrategy`. We check for non-nullness in `doInitialize()` so it suffices to check Component state.

Returns:
  a null-safe `lockoutKeyStrategy`

### check

public boolean check(@Nonnull ProfileRequestContext profileRequestContext)
Check if the authentication credentials associated with the request are subject to lockout.

Specified by:
  `check` in interface `AccountLockoutManager`
Parameters:
  `profileRequestContext` - current profile request context
Returns:
  true iff the credentials correspond to a locked account

### increment

public boolean increment(@Nonnull ProfileRequestContext profileRequestContext)
Increment the lockout counter for the authentication credentials associated with the request.

Specified by:
  `increment` in interface `AccountLockoutManager`
Parameters:
  `profileRequestContext` - current profile request context
Returns:
  true iff the counter was incremented

### clear

public boolean clear(@Nonnull ProfileRequestContext profileRequestContext)
Clear the lockout state for the authentication credentials associated with the request.

Specified by:
  `clear` in interface `AccountLockoutManager`
Parameters:
  `profileRequestContext` - current profile request context
Returns:
  true iff the state was successfully cleared

### enumerate

@Nullable public Iterable<String> enumerate(@Nonnull ProfileRequestContext profileRequestContext)
Return iterable collection of locked out keys that match a supplied partial key (i.e., are prefixed by it).

The key MUST be supplied via a `LockoutManagerContext` subcontext of the input context.

Specified by:
  `enumerate` in interface `EnumeratableAccountLockoutManager`
Parameters:
  `profileRequestContext` - current profile request context
Returns:
  the locked out keys, or a null if an error occurs

### doCheck

protected boolean doCheck(@Nonnull ProfileRequestContext profileRequestContext, @Nonnull String key, int maxAttempts, long lockoutDuration, long counterInterval, boolean increment)
Helper method to perform a check operation against a specific key.

Parameters:
  `profileRequestContext` - current profile request context
  `key` - input key to check
  `maxAttempts` - maximum allowable attempts before lockout
  `lockoutDuration` - duration of lockout
  `counterInterval` - interval before disregarding attempts
  `increment` - whether to increment the counter if already locked out
Returns:
  true iff the designated key is locked out

### doIncrement

protected boolean doIncrement(@Nonnull ProfileRequestContext profileRequestContext, @Nonnull @NotEmpty String key, int retries, long lockoutDuration, long counterInterval)
Implement invalid login attempt counter via storage service, retrying as necessary.

Parameters:
  `profileRequestContext` - current profile request context
  `key` - account lockout key
  `retries` - number of additional retries to allow
  `lockoutDuration` - duration of lockout
  `counterInterval` - interval before disregarding attempts
Returns:
  true iff successful