I work on web project which use keycloak for authentication. Can I take account IP address when deciding to block a user ? Example : if user authentication is faillure 5 times, I will block the IP address.
Best regards.
1 Answers
What you are referring to is similar to brute force attack. As per keycloak documentation, they provide feature to disable a user temporarily in case of brute force attacks.
The way this works is that if there are Max Login Failures during a period of Failure Reset Time, the account is temporarily disabled for the Wait Increment multiplied by the number of failures over the max. After Failure Reset Time is reached all failures are wiped clean.
But a disadvantage, which they have mentioned is that the server becomes vulnerable to denial of service attacks.
They recommend using a third party tool: Fail2ban, which can be pointed to keycloak log file and can be used to block certain IP addresses.
Related