Enable brute-force protection

In Axidian Access, you can configure protection against account brute-forcing for the Identity Provider component.

If this setting is enabled, when a non-existent username is entered, Axidian Access simulates the login of an existing user through Identity Provider: it displays the authentication methods, requests a password, and then displays the error Invalid username or authenticator, or the device is blocked.

If this setting is disabled, when a non-existent username is entered, Axidian Access displays the error Internal server error: User not found.

By default, this setting is disabled.

To enable brute-force protection:

1. Open the Core Server web.config configuration file located in the C:\inetpub\wwwroot\am\core folder.

2. Modify the appSettings parameter. In the bruteForceProtectionApps line, specify the value Identity Provider.

   Example

   <appSettings>
       <add key="requireHttps" value="true" />
       <add key="enableSwagger" value="false" />
       //highlight-grey-next-line
       <add key="bruteForceProtectionApps" value="Identity Provider" />
   </appSettings>

3. Save the changes and restart IIS.