Prevent locking of Administrator account

Question

Hello,
We'd like to expose our portal to the internet. This means everyone will be able to logon to the portal (after creating an UME user account). UME is configured to lock user accounts after 3 invalid login attempts.
Now how can we prevent anonymous internet users to lock the Administrator account or other system accounts like ADSUser?
The first option would be to implement this on the revert proxy, e.g. block requests containing j_user=Administrator either in the URL during a GET request or in the body during a POST request.
However, because of performance reasons, especially because of the need to scan all POST requests, this option doesn't look very attractive.
A second option would be to deploy a new JAAS LoginModule, configured to be always executed as the first one, that checks the username first and halts the login process if the username is Administrator and the request is coming from a certain IP (the reversed proxy), e.g. by throwing a RuntimeException in the login method (will that work? any other possibility besides throwing a RuntimeException?).
This doesn't look as very clean solution either.
What would be the best (safe, clean, easy) way to stop anonymous users from locking the Administrator user account?
Thanks!
Sigiswald

Answer 1

At the end we decided to write a custom LoginModule anyway.
import java.io.IOException;
import java.net.InetAddress;
import java.net.UnknownHostException;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Iterator;
import java.util.List;
import java.util.Map;
import javax.security.auth.Subject;
import javax.security.auth.callback.Callback;
import javax.security.auth.callback.CallbackHandler;
import javax.security.auth.callback.NameCallback;
import javax.security.auth.callback.UnsupportedCallbackException;
import javax.security.auth.login.LoginException;
import com.sap.engine.interfaces.security.auth.AbstractLoginModule;
import com.sap.engine.lib.security.LoginExceptionDetails;
import com.sap.engine.lib.security.http.HttpGetterCallback;
import com.sap.security.api.IUser;
import com.sap.security.api.NoSuchUserException;
import com.sap.security.api.UMException;
* <p>
* <div>This LoginModule either succeeds or fails, but in fact it
* <u>never</u> authenticates the user. What is meant is that even if
* all relevant methods of the LoginModule API - i.e. login and commit
* - return true, indicating success, the Subject is never
* authenticated. Therefore this LoginModule should <u>never</u> be
* configured as SUFFICIENT.</div>
* </p>
* <p>
* <div>The purpose of this LoginModule is to abort the authentication
* process in case an unauthorized user tries to authenticate as
* administrator and thus it stops unauthorized users from locking
* administrator accounts.</div>
* </p>
* <p>
* <div>This LoginModule accepts two optional configuration
* options:<ul>
* <li>ip_allow</li>
* <li>ip_deny</li></ul>
* The value of both options is a comma separated list of IPv4 ranges.
* e.g.
* <code>ip_allow=145.50.76.81,145.50.77.0-145.50.77.255,194.196.236.70-194.196.236.71</code>
* The localhost is added implicitly.</div>
* </p>
* <p>
* <div>If the IP address of the client that sent the HTTP request is
* within the range(s) defined by ip_allow and is not within the
* range(s) defined by ip_deny, authentication succeeds. If this is
* not the case, authentication fails if the user tries to
* authenticate by username (and password) and supplies the username
* of an existing UME user that is assigned the internal_use_only
* role. Otherwise, authentication succeeds.</div>
* </p>
* <p>
* <div>To meet its purpose, i.e. prevent the locking of administrator
* user accounts, this LoginModule <u>should</u> be configured as
* <u>REQUISITE</u> and should be in the login stack <u>before</u> the
* standard BasicPasswordLoginModule.</div>
* </p>
* @author smadou
public final class AdministratorFilterLoginModule extends AbstractLoginModule {
  private static final String INTERNAL_USE_ONLY =
    LogonUtil.getRoleid("internal_use_only");
  private static final String IP_ALLOW = "ip_allow";
  private static final String IP_DENY = "ip_deny";
  private static boolean initialized;
  private static List IPRANGE_ALLOW = new ArrayList();
  private static List IPRANGE_DENY = new ArrayList();
  private CallbackHandler callbackHandler;
  private boolean succeeded;
  public void initialize(
    Subject subject,
    CallbackHandler callbackHandler,
    Map sharedState,
    Map options) {
    super.initialize(subject, callbackHandler, sharedState, options);
    this.callbackHandler = callbackHandler;
    this.succeeded = false;
    AdministratorFilterLoginModule.initialize(options);
  public boolean login() throws LoginException {
    try {
      if (ipAllowed()) {
        succeeded = true;
        return true;
    } catch (UnsupportedCallbackException e) {
      throwUserLoginException(e);
    } catch (IOException e) {
      throwUserLoginException(e, LoginExceptionDetails.IO_EXCEPTION);
    String logonid = null;
    IUser user = null;
    String userid = null;
    try {
      logonid = getLogonid();
      user = logonid == null ? null : LogonUtil.getUser(logonid);
      userid = user == null ? null : user.getUniqueID();
    } catch (UnsupportedCallbackException e) {
      throwUserLoginException(e);
    } catch (IOException e) {
      throwUserLoginException(e, LoginExceptionDetails.IO_EXCEPTION);
    } catch (NoSuchUserException e) {
      // TODO connect to NetWeaver logging API - DEBUG
      e.printStackTrace();
    } catch (UMException e) {
      throwUserLoginException(e);
    if (userid == null) {
      return true;
    if (user.isMemberOfRole(INTERNAL_USE_ONLY, LogonUtil.RECURSIVE)) {
      throwNewLoginException(
        "Access Denied to user with logonid "
          + logonid
          + " having role "
          + INTERNAL_USE_ONLY
          + "!");
    succeeded = true;
    return true;
  public boolean commit() throws LoginException {
    return succeeded;
  public boolean abort() throws LoginException {
    return succeeded;
  public boolean logout() throws LoginException {
    succeeded = false;
    return true;
  private static synchronized void initialize(Map options) {
    if (initialized) {
      return;
    IPRANGE_ALLOW.addAll(Arrays.asList(AddressRange.parseRanges("127.0.0.1")));
    try {
      IPRANGE_ALLOW.addAll(
        Arrays.asList(
          AddressRange.parseRanges(
            InetAddress.getLocalHost().getHostAddress())));
    } catch (UnknownHostException e) {
      // TODO connect to NetWeaver logging API - INFO
      e.printStackTrace();
    String ipAllow = (String) options.get(IP_ALLOW);
    String ipDeny = (String) options.get(IP_DENY);
    if (ipAllow != null && ipAllow.length() > 0) {
      IPRANGE_ALLOW.addAll(Arrays.asList(AddressRange.parseRanges(ipAllow)));
    if (ipDeny != null && ipDeny.length() > 0) {
      IPRANGE_DENY.addAll(Arrays.asList(AddressRange.parseRanges(ipDeny)));
    initialized = true;
  private String getClientIp()
    throws UnsupportedCallbackException, IOException {
    HttpGetterCallback hgc = new HttpGetterCallback();
    hgc.setType(HttpGetterCallback.CLIENT_IP);
    callbackHandler.handle(new Callback[] { hgc });
    return (String) hgc.getValue();
  private String getLogonid()
    throws IOException, UnsupportedCallbackException {
    NameCallback nc = new NameCallback("username: ");
    callbackHandler.handle(new Callback[] { nc });
    return nc.getName();
  private boolean ipAllowed()
    throws UnsupportedCallbackException, IOException {
    String clientIp = getClientIp();
    return match(IPRANGE_ALLOW, clientIp) && !match(IPRANGE_DENY, clientIp);
  private boolean match(List ipRanges, String ip) {
    for (Iterator i = ipRanges.iterator(); i.hasNext();) {
      AddressRange range = (AddressRange) i.next();
      if (range.match(ip)) {
        return true;
    return false;
import com.sap.security.api.IRole;
import com.sap.security.api.IRoleFactory;
import com.sap.security.api.IUser;
import com.sap.security.api.IUserFactory;
import com.sap.security.api.NoSuchRoleException;
import com.sap.security.api.NoSuchUserException;
import com.sap.security.api.UMException;
import com.sap.security.api.UMFactory;
* @author smadou
public final class LogonUtil {
  static final boolean RECURSIVE = true;
  static String getRoleid(String uniqueName) {
    try {
      IRoleFactory rf = UMFactory.getRoleFactory();
      IRole role = rf.getRoleByUniqueName(uniqueName);
      return role.getUniqueID();
    } catch (NoSuchRoleException e) {
      // TODO connect to NetWeaver logging API - WARN
      e.printStackTrace();
      throw new SecurityException(
        "NoSuchRoleException while getting role with unique name ""
          + uniqueName
          + "": "
          + e.getMessage());
    } catch (UMException e) {
      // TODO connect to NetWeaver logging API - WARN
      e.printStackTrace();
      throw new SecurityException(
        "UMException while getting role with unique name ""
          + uniqueName
          + "": "
          + e.getMessage());
  static IUser getUser(String logonid)
    throws NoSuchUserException, UMException {
    IUserFactory uf = UMFactory.getUserFactory();
    return uf.getUserByLogonID(logonid);
* This code is based on
* http: //drc-dev.ohiolink.edu/browser/fedora-core/tags/2.0/src/java/fedora/server/security/IPRestriction.java
* @author smadou
public final class AddressRange {
  private static final int IP_OCTETS = 4;
  private static final int OCTET_MIN = 0;
  private static final int OCTET_MAX = (int) Math.pow(2, 8) - 1;
  private long start;
  private long end;
  private AddressRange(long start, long end) {
    this.start = start;
    this.end = end;
  public boolean match(String address) {
    return match(parseAddress(address));
  private boolean match(long address) {
    return address >= start && address <= end;
  private static long parseAddress(String address) {
    String[] octets = address.split("\.");
    if (octets.length != IP_OCTETS) {
      throw new IllegalArgumentException("invalid adress: "" + address + """);
    long lAddress = 0;
    for (int i = 0, n = octets.length; i < n; i++) {
      lAddress += parseOctet(octets[ i ], n - i - 1);
    return lAddress;
  private static long parseOctet(String octet, int byteNum)
    throws NumberFormatException {
    long lOctet = Long.parseLong(octet);
    if (lOctet < OCTET_MIN || lOctet > OCTET_MAX) {
      throw new IllegalArgumentException("invalid octet: "" + octet + """);
    return lOctet * (long) Math.pow(Math.pow(2, 8), byteNum);
  private static AddressRange parseRange(String range) {
    String[] parts = range.split("-");
    if (parts.length > 2) {
      throw new IllegalArgumentException("invalid range: "" + range + """);
    long start = parseAddress(parts[0].trim());
    long end = parts.length == 1 ? start : parseAddress(parts[1].trim());
    return new AddressRange(start, end);
  public static AddressRange[] parseRanges(String ranges) {
    String[] parts = ranges.split(",");
    AddressRange[] addressRanges = new AddressRange[parts.length];
    for (int i = 0, n = parts.length; i < n; i++) {
      addressRanges[ i ] = parseRange(parts[ i ].trim());
    return addressRanges;