Merge branch 'main' into IDP-2165

Author: ethancanne

README.md

@@ -616,11 +616,11 @@ SilAuth will rate limit failed logins by username and by every untrusted IP
 address from a login attempt.
 
 ##### tl;dr ("the short version")
-If there have been more than 10 failed logins for a given username (or IP
+If there have been more than 5 failed logins for a given username (or IP
 address) within the past hour, a captcha will be included in the webpage. The
 user may or may not have to directly interact with the captcha, though.
 
-If there have been more than 50 failed logins for that username (or IP address)
+If there have been more than 20 failed logins for that username (or IP address)
 within the past hour, logins for that username (or IP address) will be blocked
 for up to an hour.
 
@@ -646,10 +646,10 @@ also actual tests that are run to ensure those descriptions are correct.
 
 ##### Example 1
 
-- If `BLOCK_AFTER_NTH_FAILED_LOGIN` is 50, and
-- if `REQUIRE_CAPTCHA_AFTER_NTH_FAILED_LOGIN` is 10, and
+- If `BLOCK_AFTER_NTH_FAILED_LOGIN` is 20, and
+- if `REQUIRE_CAPTCHA_AFTER_NTH_FAILED_LOGIN` is 5, and
 - if there have been 4 failed login attempts for `john_smith`, and
-- there have been 10 failed login attempts from `11.22.33.44`, and
+- there have been 5 failed login attempts from `11.22.33.44`, and
 - there have been 3 failed login attempts from `192.168.1.2`, and
 - someone tries to login as `john_smith` from `192.168.1.2` and their request
   goes through a proxy at `11.22.33.44`, then
@@ -658,7 +658,7 @@ also actual tests that are run to ensure those descriptions are correct.
 ##### Example 2
 
 - However, if all of the above is true, but
-- there have now been 55 failed login attempts from `11.22.33.44`, then
+- there have now been 25 failed login attempts from `11.22.33.44`, then
 - any request involving that IP address will be blocked for 25 seconds after
   the most recent of those failed logins.
 

composer.lock

@@ -40,4 +40,4 @@ Logs information (common name, eduPrincipalPersonalName, employee number, IdP, S
 The following config is not needed on AWS, but it is needed locally
 'DynamoEndpoint' ex. http://dynamo:8000
 
-Ensure the DYNAMO_ACCESS_KEY_ID and DYNAMO_SECRET_ACCESS_KEY environment variables are set as shown in the local.env.dist file.
+Ensure the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables are set as shown in the local.env.dist file.

docs/editing_authprocs.md

@@ -99,10 +99,10 @@ ENV_ID=
 # A valid format for 'baseurlpath' is: [(http|https)://(hostname|fqdn)[:port]]/[path/to/simplesaml/]
 BASE_URL_PATH=
 
-# DYNAMO_ACCESS_KEY_ID and DYNAMO_SECRET_ACCESS_KEY can be set to AWS IAM credentials with access
+# AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY can be set to AWS IAM credentials with access
 # to a DynamoDB table for storage of user access logs. For more information see docs/editing_authprocs.md
-DYNAMO_ACCESS_KEY_ID
-DYNAMO_SECRET_ACCESS_KEY
+AWS_ACCESS_KEY_ID
+AWS_SECRET_ACCESS_KEY
 
 # HELP_CENTER_URL can be set to a URL for an end-user support site. If provided, it will be used for a
 # link address on the IdP selection page (selectidp-links) and the IdP login page (loginuserpass).

local.env.dist

@@ -168,7 +168,7 @@
             <button
               type="button"
               onclick="forgotPassword()"
-              class="mdl-button mdl-button--colored mdl-typography--caption"
+              class="mdl-button mdl-button--colored mdl-typography--raised"
             >
               {{ '{login:forgot}'|trans }}
             </button>

modules/material/themes/material/silauth/loginuserpass.twig

@@ -17,8 +17,8 @@
  */
 class Authenticator
 {
-    const REQUIRE_CAPTCHA_AFTER_NTH_FAILED_LOGIN = 10;
-    const BLOCK_AFTER_NTH_FAILED_LOGIN = 50;
+    const REQUIRE_CAPTCHA_AFTER_NTH_FAILED_LOGIN = 5;
+    const BLOCK_AFTER_NTH_FAILED_LOGIN = 20;
     const MAX_SECONDS_TO_BLOCK = 3600; // 3600 seconds = 1 hour
 
     private ?AuthError $authError = null;

modules/silauth/src/Auth/Source/auth/Authenticator.php

@@ -5,6 +5,7 @@
 use Aws\DynamoDb\Marshaler;
 use Aws\Sdk;
 use Exception;
+use Sil\PhpEnv\Env;
 use SimpleSAML\Auth\ProcessingFilter;
 use SimpleSAML\Error\MetadataNotFound;
 use SimpleSAML\Logger;
@@ -23,12 +24,6 @@
  */
 class LogUser extends ProcessingFilter
 {
-
-    const AWS_ACCESS_KEY_ID_ENV = "DYNAMO_ACCESS_KEY_ID";
-
-    const AWS_SECRET_ACCESS_KEY_ENV = "DYNAMO_SECRET_ACCESS_KEY";
-
-
     const IDP_KEY = "saml:sp:IdP"; // the key that points to the entity id in the state
 
     // the metadata key for the IDP's Namespace code (i.e. short name)
@@ -78,17 +73,6 @@ public function process(array &$state): void
             return;
         }
 
-        $awsKey = getenv(self::AWS_ACCESS_KEY_ID_ENV);
-        if (!$awsKey) {
-            Logger::error(self::AWS_ACCESS_KEY_ID_ENV . " environment variable is required for LogUser.");
-            return;
-        }
-        $awsSecret = getenv(self::AWS_SECRET_ACCESS_KEY_ENV);
-        if (!$awsSecret) {
-            Logger::error(self::AWS_SECRET_ACCESS_KEY_ENV . " environment variable is required for LogUser.");
-            return;
-        }
-
         assert(is_array($state));
 
         // Get the SP's entity id
@@ -99,12 +83,16 @@ public function process(array &$state): void
 
         $sdkConfig = [
             'region' => $this->dynamoRegion,
-            'version' => 'latest',
-            'credentials' => [
+        ];
+
+        $awsKey = Env::getString('AWS_ACCESS_KEY_ID', Env::getString('DYNAMO_ACCESS_KEY_ID'));
+        $awsSecret = Env::getString('AWS_SECRET_ACCESS_KEY', Env::getString('DYNAMO_SECRET_ACCESS_KEY'));
+        if (!empty($awsSecret) && !empty($awsKey)) {
+            $sdkConfig['credentials'] = [
                 'key' => $awsKey,
                 'secret' => $awsSecret,
-            ],
-        ];
+            ];
+        }
 
         if (!empty($this->dynamoEndpoint)) {
             $sdkConfig['endpoint'] = $this->dynamoEndpoint;