Search code examples
keycloakbrute-forcekeycloak-services

Keycloak brute force attack: Locks account in 2 failures


I am using Keycloak 4.8.0.Final. I have enabled Brute Force detection from Keycloak admin with default settings.

Issue: currently it locks account in 2 subsequent login failures. Where i want it to lock after 3 login failures.

Can you help me to achieve this.


Solution

  • By default "Quick Login Check Milli Seconds" is 1000. That means if there are 2 failures within a one-second then the account will be locked. It looks like you have to set the next settings:

    Permanent Lockout = "ON"
    Max Login Failures = "3"
    Quick Login Check Milli Seconds = "1"