Not so long ago I blogged about using Salted authentication
https://dankeeley.wordpress.com/2018/09/13/pentaho-security-full-jdbc-passwords-with-salts/
Well; it turns out the Pentaho authentication layer despite being spring security is not really “up to date” in a lot of things.
A classic example is preventing brute force authentication.
Now; I’m currently integrating to a home grown security system, hence this is an issue. If we were going LDAP like most would then it’s a non-issue, because your LDAP would handle this.
So; Whats the requirements? Well simply:
- Call a specific procedure once logged on
- Call a different procedure if login fails
The former is easily achieved using a session startup action. see sessionStartupActions.xml in pentaho-solutions/system. In an ideal world you could use the startup rules cTool which lets you code these rules using Kettle but unfortunately it’s broken in 8.1 (I believe fixed in 8.2 but not proven)
The latter is somewhat harder. You must build a custom spring authentication failure handler. Thankfully that’s as easy as:
- following this ultra simple blog example: https://www.baeldung.com/spring-security-custom-authentication-failure-handler
- enabling the new handler in applicationContext-spring-security.xml file.
b.t.w. the username is in the request – so access it like so:
request.getParameter("j_username");
So there you go. we now have a relatively easy hook into authentication failures in the BA Server.
Codeks Blog 