3.12 Detecting the Brute Force Attack

When you enable the RequestLogger filter in the web.xml file, the debug information for each request, including the source IP address is recorded. You can check log messages and identify the IP address of the attacker and block these IP addresses.

This filter logs the client IP addresses of WS Trust, WS-Fed request. This filter is not required for logging client IP addresses of SAML requests.

Perform the following steps to enable the RequestLogger filter:

  1. Modify Identity Server’s web.xml.

  2. Uncomment the following snippet:

         <filter>
        <filter-name>RequestLogger</filter-name>
        <filter-class>com.novell.nidp.servlets.filters.debug.RequestLogger</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>RequestLogger</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

For information about how to modify a configuration file, see Modifying Configurations in the NetIQ Access Manager CE 24.2 (v5.1) Administration Guide.