Invalidate authentication session on repeated Recovery Code failures

Closes keycloak#26180 Signed-off-by: Douglas Palmer <dpalmer@redhat.com>
ahus1 · Mar 22, 2024 · 95e0e94 · 95e0e94
1 parent 974d81b
commit 95e0e94
Showing 1 changed file with 5 additions and 2 deletions.
diff --git a/...g/keycloak/authentication/authenticators/browser/RecoveryAuthnCodesFormAuthenticator.java b/...g/keycloak/authentication/authenticators/browser/RecoveryAuthnCodesFormAuthenticator.java
@@ -48,13 +48,13 @@ private boolean isRecoveryAuthnCodeInputValid(AuthenticationFlowContext authnFlo
         MultivaluedMap<String, String> formParamsMap = authnFlowContext.getHttpRequest().getDecodedFormParameters();
         String recoveryAuthnCodeUserInput = formParamsMap.getFirst(RecoveryAuthnCodesUtils.FIELD_RECOVERY_CODE_IN_BROWSER_FLOW);
 
-        if (ObjectUtil.isBlank(recoveryAuthnCodeUserInput)) {
+        if (ObjectUtil.isBlank(recoveryAuthnCodeUserInput)
+                || "true".equals(authnFlowContext.getAuthenticationSession().getAuthNote(AbstractUsernameFormAuthenticator.SESSION_INVALID))) {
             authnFlowContext.forceChallenge(createLoginForm(authnFlowContext, true,
                     RecoveryAuthnCodesUtils.RECOVERY_AUTHN_CODES_INPUT_DEFAULT_ERROR_MESSAGE,
                     RecoveryAuthnCodesUtils.FIELD_RECOVERY_CODE_IN_BROWSER_FLOW));
             return result;
         }
-        RealmModel targetRealm = authnFlowContext.getRealm();
         UserModel authenticatedUser = authnFlowContext.getUser();
         if (!isDisabledByBruteForce(authnFlowContext, authenticatedUser)) {
             boolean isValid = authenticatedUser.credentialManager().isValid(
@@ -82,6 +82,9 @@ private boolean isRecoveryAuthnCodeInputValid(AuthenticationFlowContext authnFlo
                 }
             }
         }
+        else {
+            authnFlowContext.getAuthenticationSession().setAuthNote(AbstractUsernameFormAuthenticator.SESSION_INVALID, "true");
+        }
         return result;
     }