Login security Lind-Thomsen  2015-11-09 04:44
Status: Closed
 
Hi

Is it possible to automatically block a user after a certain number of failed attempts?

Best wishes
Allan Lind-Thomsen
 
 
Jon (LabKey DevOps) responded:  2015-11-09 11:17
Hi Allan,

Unfortunately, the current platform design doesn't contain this feature. But from what I can see, it looks like you could develop your own custom module to where it can act as the login page and give you the desired effect of blocking users that fail at login attempts after so many times. You could use the API (the Java API would probably be best) to run a check against the UserAuditEvent table in the auditLog schema for the entire platform, verifying whether if a user had failed to login after X amount of times in a certain timeframe and then locking the user out by deactivating the user or preventing the session from continuing until after a certain amount of time.

Regards,

Jon
 
Matthew Bellew responded:  2015-11-09 11:30
Also, note that there is an internal rate limiter on password attempts to prevent brute force password attacks.

Matt