SEC-2516: Hardening Authentication Controls

Matt Konda (Migrated from SEC-2516) said:

Provide capability and reference documentation for setting up the following features related to authentication (extending slightly on existing Spring security capabilities):

• Configurable lockout after N failed attempts
• Auto-unlock after a period of M minutes or via email
• Password reset flow (token + time limit)
• Temporary access pending email confirmation flow (time limited access until email link with token followed)
• Configurable password complexity enforcement
• Notification of password change (configurable to send email)
• Filter to prevent multiple concurrent sessions with the same login
• Support for multi-factor authentication

Idea would be to put each of these as a separate story that is part of this epic.

Inspired by:
https://www.owasp.org/index.php/Authentication_Cheat_Sheet
https://github.com/plataformatec/devise

Start by splitting the listed authentication controls into separate stories, as the issue suggests, and review the existing Spring Security capabilities. Use the linked OWASP Authentication Cheat Sheet and Devise project as references. Each story is done when its capability and corresponding reference documentation have defined scope and acceptance criteria.