Skip to content

Commit

Permalink
Docker README updates for ssp 2.2.2
Browse files Browse the repository at this point in the history
  • Loading branch information
pradtke committed May 16, 2024
1 parent 1df52db commit a3a7ed4
Show file tree
Hide file tree
Showing 2 changed files with 10 additions and 5 deletions.
13 changes: 9 additions & 4 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -60,6 +60,8 @@ All included limiters support these 2 settings:

Configuration should be done in `authsources.php`. The `RateLimitUserPass` authsource wraps other auth sources to enforce the rate limits. Each of your existing `authsource` definitions should get moved inside the `'delegate'` key.

`limiters` are run in the order defined, and not in numerical order of the keys.

### Sample Configuration

#### Standalone delegate/SSP 2 style configuration
Expand Down Expand Up @@ -202,16 +204,19 @@ docker run -d --name ssp-ratelimit \
--mount type=bind,source="$(pwd)/tests/docker/config-override.php",target=/var/simplesamlphp/config/config-override.php,readonly \
--mount type=bind,source="$(pwd)/tests/docker/cert/",target=/var/simplesamlphp/cert/,readonly \
--mount type=bind,source="$(pwd)/tests/docker/public/looping-login.php",target=/var/simplesamlphp/public/looping-login.php,readonly \
-p 443:443 cirrusid/simplesamlphp:v2.0.0
-p 443:443 cirrusid/simplesamlphp:v2.2.2
```

Then log in as `admin:secret` to https://ratelimit.local.stack-dev.cirrusidentity.com/simplesaml/module.php/core/frontpage_welcome.php
to confirm things work.
Then log in as `admin:secret` to https://ratelimit.local.stack-dev.cirrusidentity.com/simplesaml/
to confirm SSP is running.

## Things to try

### Blocking logins

To reach the `admin` test login endpoints you must first authenticate as an admin. Login to https://ratelimit.local.stack-dev.cirrusidentity.com/simplesaml/admin
as `admin:secret`

The [example-userpass](https://ratelimit.local.stack-dev.cirrusidentity.com/simplesaml/module.php/admin/test/example-userpass)
authsource is configured with a low number of attempts for logins. Try logging in 3 or 4 times with the same username and wrong password and
you should see log lines like
Expand All @@ -225,7 +230,7 @@ If you try varying usernames and the same password (a password stuffing attack)
### Loop Detection

Visiting the [looping-login page](https://ratelimit.local.stack-dev.cirrusidentity.com/simplesaml/looping-login.php)
will issues a request as an SP to login with a local IdP and print out the attributes. User `member`, password `memberpass`.
will issue a request as an SP to log in with a local IdP and print out the attributes. User `member`, password `memberpass`.
If you add a `loop` query parameter
you can mimic a misbehaving SP that continuously sends a user to the IdP to login. The IdP is configured (see `saml20-idp-hosted.php`)
with loop detection and will display an error page after too many loops.
Expand Down
2 changes: 1 addition & 1 deletion locales/en/LC_MESSAGES/ratelimit.po
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ msgstr "Issue sending you to the application"

msgid "App Loop Message"
msgstr "The application you are trying to access seems to be having problems."
"The application ( %APPNAME% ) is not accepting your login and keeps requesting that you login again."
"The application ( %APPNAME% ) is not accepting your login and keeps requesting that you log in again."

msgid "Retry Login Button"
msgstr "Retry Login"

0 comments on commit a3a7ed4

Please sign in to comment.