SECURITY: Password security policy: MAX_FAILED_LOGIN_ATTEMPTS is not properly enforced for WebSocket connections

Details

Detail name Value
Changelog Number 12918
Type Bug
Status Resolved
Affected Versions Exasol 6.2.0, Exasol 7.0.0, Exasol 7.1.0
Fix Versions Exasol 7.1.2, Exasol 6.2.17, Exasol 7.0.13
Resolution Date 2021-09-06

Problem

  1. In Exasol 6.2.x, the MAX_FAILED_LOGIN_ATTEMPTS portion of the password security policy is not enforced at all for WebSocket connections.
  2. In Exasol 7.0.x and 7.1.x, the MAX_FAILED_LOGIN_ATTEMPTS portion of the password security policy is not properly enforced for WebSocket connections if the username provided during login is not completely upper case. As a result, logins for users who exceeded the maximum number of failed login attempts may still be possible if the correct password is provided.

Example for Exasol 7.0.x and 7.1.x

-- Create user and password policy
CREATE USER USER_1 IDENTIFIED BY "correct_password";
ALTER SYSTEM SET PASSWORD_SECURITY_POLICY='MAX_FAILED_LOGIN_ATTEMPTS=3';

-- Try to login with the wrong password using WebSockets
websocket_login(user='USER_1', password='wrong_password')
websocket_login(user='USER_1', password='wrong_password')
websocket_login(user='USER_1', password='wrong_password')
websocket_login(user='USER_1', password='wrong_password')

-- Login fails
websocket_login(user='USER_1', password='correct_password')

-- Login succeeds
websocket_login(user='user_1', password='correct_password')

Solution

The MAX_FAILED_LOGIN_ATTEMPTS portion of the password security policy will be properly enforced.