Issue: Improve behavior for repeated incorrect login attempts

[nooreldeenmansour]

Show a better error message for repeated incorrect login attempts, currently it shows Maximum number of authentication attempts reached, but the user is able to try again without interruption.

We could probably mimic the behaviors set by the default login (non-authd), where it basically "deselects that user", and requires you to re-click on it. or mimic the sudo behavior: sudo-rs: Maximum 3 incorrect authentication attempts, then it requires you to re-execute the sudo command again.

[adombeck]

We noticed that in GDM, it just asks you again immediately even when showing "Maximum number of authentication attempts reached", which is confusing.

However, the behavior is also not ideal when authenticating with SSH, in a TTY or with sudo. They all re-ask for the password three times on PAM_AUTH_ERR. Our PAM module only returns PAM_AUTH_ERR after asking itself for three times, so in effect the password prompt is shown nine times, with a "Maximum number of authentication attempts reached" after every third message:

ssh test@ubudev1.onmicrosoft.com@192.168.122.54
== Local Password Authentication ==
Enter 'r' to cancel the request and go back to select the authentication method
(test@ubudev1.onmicrosoft.com@192.168.122.54) Enter your local password:
> 
Incorrect password, please try again.
== Local Password Authentication ==
Enter 'r' to cancel the request and go back to select the authentication method
(test@ubudev1.onmicrosoft.com@192.168.122.54) Enter your local password:
> 
Incorrect password, please try again.
== Local Password Authentication ==
Enter 'r' to cancel the request and go back to select the authentication method
(test@ubudev1.onmicrosoft.com@192.168.122.54) Enter your local password:
> 
Maximum number of authentication attempts reached
== Local Password Authentication ==
Enter 'r' to cancel the request and go back to select the authentication method
(test@ubudev1.onmicrosoft.com@192.168.122.54) Enter your local password:
> 
Incorrect password, please try again.
== Local Password Authentication ==
Enter 'r' to cancel the request and go back to select the authentication method
(test@ubudev1.onmicrosoft.com@192.168.122.54) Enter your local password:
> 
Incorrect password, please try again.
== Local Password Authentication ==
Enter 'r' to cancel the request and go back to select the authentication method
(test@ubudev1.onmicrosoft.com@192.168.122.54) Enter your local password:
> 
Maximum number of authentication attempts reached
== Local Password Authentication ==
Enter 'r' to cancel the request and go back to select the authentication method
(test@ubudev1.onmicrosoft.com@192.168.122.54) Enter your local password:
> 
Incorrect password, please try again.
== Local Password Authentication ==
Enter 'r' to cancel the request and go back to select the authentication method
(test@ubudev1.onmicrosoft.com@192.168.122.54) Enter your local password:
> 
Incorrect password, please try again.
== Local Password Authentication ==
Enter 'r' to cancel the request and go back to select the authentication method
(test@ubudev1.onmicrosoft.com@192.168.122.54) Enter your local password:
> 
Maximum number of authentication attempts reached
test@ubudev1.onmicrosoft.com@192.168.122.54: Permission denied (keyboard-interactive).

I see two options:

1. Return PAM_AUTH_ERR after the first incorrect attempt (that's what pam_unix does)
2. Return PAM_MAXTRIES after the max attemps. I didn't try the effect of that in practice, but according to pam_sm_authenticate(3), the caller should not try again when that is returned.

[adombeck]

Relevant code:

authd/authd-oidc-brokers/internal/broker/broker.go

Lines 564 to 570 in 81db5c3

	if access == AuthRetry {
	session.attemptsPerMode[session.selectedMode]++
	if session.attemptsPerMode[session.selectedMode] == maxAuthAttempts {
	access = AuthDenied
	iadResponse = errorMessage{Message: "Maximum number of authentication attempts reached"}
	}
	}

authd/pam/internal/adapter/authentication.go

Lines 355 to 359 in 81db5c3

	case auth.Denied:
	if authMsg == "" {
	authMsg = "Access denied"
	}
	return m, sendEvent(pamError{status: pam.ErrAuth, msg: authMsg})

To return PAM_MAXTRIES instead, we would have to add a new constant in https://github.com/canonical/authd/blob/81db5c34b1e94ccae3b42b6ea61a124088292468/internal/brokers/auth/consts.go and https://github.com/canonical/authd/blob/81db5c34b1e94ccae3b42b6ea61a124088292468/authd-oidc-brokers/internal/broker/consts.go.