This topic guides you through configuring
...
reCAPTCHA for the single sign-on flow. By configuring
...
reCAPTCHA, you can mitigate or block brute force attacks.
Info |
---|
|
...
|
...
Set up reCaptcha reCAPTCHA with the WSO2 Identity Server. For instructions on how to do this and more information about reCaptchareCAPTCHA, see Setting Up ReCaptcha.
Note: To If you want to modify the filter mapping for reCaptcha, open reCAPTCHA:Note - Open the
web.
xml
file in the<IS_HOME>/repository/conf/tomcat/carbon/WEB-INF
- directory.
Locate the following filter
and modify the relevant URL patterns if required.
Code Block language xml <filter> <filter-name>CaptchaFilter</filter-name> <filter-class>org.wso2.carbon.identity.captcha.filter.CaptchaFilter</filter-class>
</filter>
<filter-mapping> <filter-name>CaptchaFilter</filter-name> <url-pattern>/samlsso</url-pattern> <url-pattern>/oauth2</url-pattern> <url-pattern>/commonauth</url-pattern> <dispatcher>FORWARD</dispatcher> <dispatcher>REQUEST</dispatcher>
</filter-mapping>
- Open the
- Start the WSO2 IS Identity Server and login sign in to the management consoleManagement Console.
- Click List under Identity Providers found in the Main tab.
- Click Resident Identity Provider and expand the Login Policies tab. Then, expand the Captcha for SSO Login tab.
Select Enable and enter a value for the Max failed attempts field. For example, if you enter 3, reCaptcha will be re-enabled after 3 failed attempts.
Note:Note - On the Main tab, click Identity > Identity Providers > Resident.
- To configure captcha:
- Expand Login Policies > Captcha for SSO Login.
Provide the required data as given below.
Field Description Sample Value Enable This determines whether the captcha verification at SSO should be enabled or not. Enable Max failed attempts This defines the maximum number of failed attempts allowed without having to use the captcha.
Note This value should be less than the number of failed attempts configured for account locking in the
You have now successfully configured reCaptcha for the single sign on flow. If the number of failed attempts reaches the maximum configured value, the following reCaptcha window appears.
next step.
3
- Expand Login Policies > Captcha for SSO Login.
To configure account locking:
Warning This configuration ensures that user account gets locked when an incorrect password is typed even after using the captcha.
Expand Login Policies > Account Locking.
Provide the required data as given below.
Field Description Sample Value Account Lock Enabled This determines whether the accounts should get locked for failed logins or not.
Enabled Maximum Failed Login Attempts This defines the maximum number of failed attempts allowed.
5
Account Unlock Time This defines the duration in minutes for which the account is locked for. 5
Lock Timeout Increment Factor This defines how the
account unlock time
should be increased for every subsequent account locking.2
Enable Notification Internally Management This determines whether the client application handles notifications or not. Selected
Click Update.
You have successfully configured reCAPTCHA for SSO.Access the WSO2 Identity Server Dashboard.
Attempt signing in as an administrator with an incorrect password for three times. The reCAPTCHA appears.