No rate limit on the single sign-on login
Description
The single sign-on login page accepts an unlimited number of password attempts. In the penetration test the tester ran thousands of guesses against a test account without being slowed or locked out. Accounts with weak passwords are therefore open to guessing.
Summary
On trackThis workflow is complete.
Completed
on
The identity provider now throttles failed sign-ins per account and per address and locks the account after repeated failures. The setting is part of the standard configuration.
Completed
on
A scripted run of 200 failed attempts was stopped after the fifth one. The throttle works as configured.