Added check on MFA code by the user (thanks Dirk of S-Unit for reporting after pentests!)

Added rate limit on attempts for MFA codes. Will block after user after 3 times (just like normal login attempts)
Custom info and error messages are now possible
Small documentation fixes

Author: pimvdnoll

2fa.mpr

@@ -66,6 +66,21 @@ public ISession execute() throws Exception {
 						IUser user = Core.getUser(sysContext, userMfaObj.getUsername());
 						return Core.initializeSession(user, this.currentSessionId);
 					} 
+					else if (userMfaObj.getUsername() != null && userMfaObj.getUsername() != "") {
+						IUser user = Core.getUser(sysContext, userMfaObj.getUsername());
+						if(user != null) {
+							Object obj = (Integer)user.getMendixObject().getValue(sysContext,"FailedLogins")+1;
+							user.getMendixObject().setValue(sysContext,"FailedLogins",obj);
+							if ( (Integer)user.getMendixObject().getValue(sysContext,"FailedLogins") >= 3) {
+								user.getMendixObject().setValue(sysContext,"Blocked",true);
+								Core.commit(sysContext, user.getMendixObject());
+								_logNode.debug( "Custom MFA to much attempts FAILED: user '" + userMfaObj.getUsername() + "' blocked" );
+								throw new UserBlockedException("Custom MFA check: User '"+ userMfaObj.getUsername() + "' blocked");
+							}
+							Core.commit(sysContext, user.getMendixObject());
+						}
+						return oldSession;
+					}
 					else {
 						return oldSession;
 					}
@@ -127,7 +142,16 @@ else if( !Core.authenticate(sysContext, user, this.password)) {
 				return super.execute();
 			}
 			else {
-				_logNode.debug( "Custom Login FAILED: validation for user '" + this.userName + "' with code '"+mfaCode+"'." );
+				_logNode.debug( "Custom MFA code validation FAILED: mfa check for user '" + this.userName + "' with code '"+mfaCode+"'." );
+				Object obj = (Integer)user.getMendixObject().getValue(sysContext,"FailedLogins")+1;
+				user.getMendixObject().setValue(sysContext,"FailedLogins",obj);
+				if ( (Integer)user.getMendixObject().getValue(sysContext,"FailedLogins") >= 3) {
+					user.getMendixObject().setValue(sysContext,"Blocked",true);
+					Core.commit(sysContext, user.getMendixObject());
+					_logNode.debug( "Custom MFA to much attempts FAILED: user '" + this.userName + "' blocked" );
+					throw new UserBlockedException("Custom MFA check: User '"+ this.userName + "' blocked");
+				}
+				Core.commit(sysContext, user.getMendixObject());
 				throw new AuthenticationRuntimeException(" Custom Login FAILED for user '" + this.userName + "'.");
 			}
 		}

Output/MFAmodule_Mx8188_v1_5.mpk

@@ -6,8 +6,8 @@
 
 public enum Enum_MessageType
 {
-	Info(new java.lang.String[][] { new java.lang.String[] { "en_US", "Info" } }),
-	Error(new java.lang.String[][] { new java.lang.String[] { "en_US", "Error" } });
+	Info(new java.lang.String[][] { new java.lang.String[] { "en_US", "Info" }, new java.lang.String[] { "nl_NL", "Info" } }),
+	Error(new java.lang.String[][] { new java.lang.String[] { "en_US", "Error" }, new java.lang.String[] { "nl_NL", "Error" } });
 
 	private java.util.Map<java.lang.String, java.lang.String> captions;