Skip to main content

Enable brute-force protection

In Axidian Access, you can configure protection against account brute-forcing for the Identity Provider component.

If this setting is enabled, when a non-existent username is entered, Axidian Access simulates the login of an existing user through Identity Provider: it displays the authentication methods, requests a password, and then displays the error Invalid username or authenticator, or the device is blocked.

If this setting is disabled, when a non-existent username is entered, Axidian Access displays the error Internal server error: User not found.

By default, this setting is disabled.

To configure brute-force protection, perform the following actions:

  1. Open the Core Server configuration file web.config located in C:\inetpub\wwwroot\am\core.
  2. Modify the appSettings parameter. In the bruteForceProtectionApps line, specify the modules for which you want to enable brute-force protection, separated by commas.
Example
<appSettings>
    <add key="bruteForceProtectionApps" value="Identity Provider, Windows Logon, IIS Extension" />
    ...
</appSettings>
  1. Save the changes and restart IIS.