feat(security): LoginThrottle — per-username+IP LDAP-bind failure lockout (arch-review P1)

Claude-Session: https://claude.ai/code/session_01MtdgwpEeCUn6cUA5f1LMPj
2026-07-10 05:01:05 -04:00
parent fb491a5342
commit bd6c310825
4 changed files with 331 additions and 0 deletions
@@ -99,6 +99,12 @@ public static class ServiceCollectionExtensions
        services.AddOptions<SecurityOptions>().ValidateOnStart();
        services.AddSingleton<IValidateOptions<SecurityOptions>, SecurityOptionsValidator>();

+        // Fixed-window LDAP-bind failure lockout (arch-review P1). A singleton so its
+        // per-{username|ip} failure counters are shared across every request on this node;
+        // consulted before, and updated after, every LDAP-bind surface (login/token endpoints
+        // and the ManagementAuthenticator-fronted management/audit/debug paths).
+        services.AddSingleton<LoginThrottle>();
+
        // Note: the old SecurityOptionsValidator (which fail-fast-validated LdapServer +
        // LdapSearchBase) is gone — those keys moved into the shared LdapOptions, whose
        // LdapOptionsValidator (registered with ValidateOnStart by AddZbLdapAuth above)