Brute Force Detection¶
Altair SLC Hub supports brute force detection via Keycloak's built-in protection mechanism. When enabled, Keycloak tracks failed login attempts and can temporarily lock accounts or slow down repeated attempts to prevent automated password guessing attacks.
Tip
Brute force detection works best alongside a sensible password policy and MFA. On its own it slows down attackers but does not stop them if they have already obtained a valid password.
Where to configure it¶
- Open the Keycloak Admin Console.
- Go to Realm settings > Security defenses > Brute force detection.
Modes¶
Keycloak offers two brute force detection modes:
| Mode | Description |
|---|---|
| Temporary lockout | Locks the account for a configurable period after a given number of failed attempts. The lockout duration increases with repeated failures. |
| Permanent lockout | Permanently locks the account after a given number of failed attempts. An administrator must manually unlock the account. |
Key settings¶
| Setting | Description |
|---|---|
| Max login failures | The number of failed attempts before the account is locked |
| Wait increment | The amount of time added to the lockout duration after each failure |
| Max wait | The maximum lockout duration for temporary lockouts |
| Failure reset time | The time after which the failure count resets if no further failures occur |
| Quick login check | Locks the account briefly if login attempts occur too rapidly, regardless of the failure count |
Unlocking a locked account¶
If a user is locked out, an administrator can unlock their account manually:
Keycloak Admin Console > Users > [select user] > Credentials > Reset password
Alternatively, for temporary lockouts, the account will unlock automatically once the lockout duration has elapsed.
Keycloak Documentation
For full details on brute force detection, see the official Keycloak documentation: Keycloak — Brute Force Detection.