public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Auth: Add setting to disable username based brute force login protection (#109152)

Browse Source 
* Add setting to disable username based brute force login protection

* Use new DisableUsernameLoginProtection setting in tests where appropriate

* Update documentation for other brute force directives

* Avoid unecessary database calls

* Add test cases for username and IP protection settings
This commit is contained in:
Théo Brigitte
2025-08-06 14:08:49 +00:00
committed by GitHub
parent f82ea23061
commit 5c50fc6385
6 changed files with 156 additions and 48 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/sources/setup-grafana/configure-grafana/_index.md
+6 -2
View File
@@ -703,13 +703,17 @@ PostgreSQL, MySQL, and MSSQL data sources don't use the proxy and are not affect
Set to `true` to disable [brute force login protection](https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html#account-lockout).
Default is `false`.
An existing user's account is unable to login for five minutes if all login attempts are spent within a 5 minute window.
Login is blocked for five minutes if all login attempts are spent within a 5 minute window.
#### `brute_force_login_protection_max_attempts`
Configure how many login attempts a user can have within a five minute window before their account is locked.
Configure how many login attempts can be made within a five minute window before being blocked.
Default is `5`.
#### `disable_username_login_protection`
Set to `true` to disable [brute force login protection by username](https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html#account-lockout). Default is `false`. User will be unable to login for 5 minutes if all login attempts are spent within a 5 minute window.
#### `disable_ip_address_login_protection`
Set to `true` to disable [brute force login protection by IP address](https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html#account-lockout). Default is `true`. Anyone from the IP address will be unable to login for 5 minutes if all login attempts are spent within a 5 minute window.