feat: add account lockout and login failure detection for PingFederate provider

Author: SESA826635

pkg/provider/pingfed/pingfed.go

@@ -8,6 +8,7 @@ import (
 	"log"
 	"net/http"
 	"net/url"
+	"strings"
 	"time"
 
 	"github.com/PuerkitoBio/goquery"
@@ -74,6 +75,15 @@ func (ac *Client) follow(ctx context.Context, req *http.Request) (string, error)
 		return "", errors.Wrap(err, "failed to build document from response")
 	}
 
+	// Check for authentication errors first
+	if msg, ok := docIsLoginFail(doc); ok {
+		logger.WithField("type", "authentication-error").Debug("doc detect")
+		return "", fmt.Errorf(msg)
+	} else if msg, ok := docIsAccountLocked(doc); ok {
+		logger.WithField("type", "account-locked").Debug("doc detect")
+		return "", fmt.Errorf(msg)
+	}
+
 	var handler func(context.Context, *goquery.Document, *url.URL) (context.Context, *http.Request, error)
 
 	if docIsFormRedirectToTarget(doc, ac.idpAccount.TargetURL) {
@@ -358,6 +368,27 @@ func extractSAMLResponse(doc *goquery.Document) (v string, ok bool) {
 	return doc.Find("input[name=\"SAMLResponse\"]").Attr("value")
 }
 
+// docIsLoginFail checks for login authentication failures
+func docIsLoginFail(doc *goquery.Document) (v string, ok bool) {
+	isLoginFail := doc.Find(".ping-error").Size() >= 1
+	if isLoginFail {
+		errorText := doc.Find(".ping-error").Text()
+		return strings.Join(strings.Fields(errorText), " "), true
+	}
+	return "", false
+
+}
+
+// docIsAccountLocked checks if user account is locked or blocked
+func docIsAccountLocked(doc *goquery.Document) (v string, ok bool) {
+	isAccountLocked := doc.Find(".window.settings.blocked").Size() > 0
+	if isAccountLocked {
+		errorText := strings.TrimSpace(doc.Find(".window.settings.blocked .error-text .text").Text())
+		return strings.Join(strings.Fields(errorText), " "), true
+	}
+	return "", false
+}
+
 // ensures given url is an absolute URL. if not, it will be combined with the base URL
 func makeAbsoluteURL(v string, base string) string {
 	if u, err := url.ParseRequestURI(v); err == nil && !u.IsAbs() {