pwdFailureTime behavior for accounts that are set to no lockout

Edit online

You can compare the differences in pwdFailureTime behavior with accounts that are set to no lockout after applying Interim Fix 6.4.0.19.

When a user account is set to no lockout, for example, by setting pwdLockout=false, pwdMaxFailure=0 or cn=noPwdPolicy, on every bind failure attempt, the value of pwdFailureTime attribute is appended with the recent time stamp entry. This process continues for every bind failure attempt.

Example scenario

Global password policy is set to the following values:
ibm-pwdPolicyStartTime=20190609170951.417254Z
pwdInHistory=0
pwdCheckSyntax=1
pwdGraceLoginLimit=0
pwdLockoutDuration=0
pwdMaxFailure=0
pwdFailureCountInterval=0
passwordMaxRepeatedChars=0
pwdMaxAge=99
pwdMinAge=0
pwdExpireWarning=0
pwdMinLength=5
passwordMinAlphaChars=0
passwordMinOtherChars=0
passwordMinDiffChars=0
ibm-pwdPolicy=true
pwdLockout=false
pwdAllowUserChange=true
pwdMustChange=false
pwdSafeModify=false
ibm-pwdGroupAndIndividualEnabled=true

or

ibm-pwdIndividualPolicyDN is set to cn=noPwdPolicy for a user account.

Behavior before you apply IF 6.4.0.19

With this setting, if you make an invalid bind attempt, pwdFailureTime registers time stamps of the consecutive authentication failures even though the user account is set to no lockout. This process continues for every bind failure and the pwdFailureTime continues growing until a user attempts a successful bind.

ldapmodify -p 389 -D cn=test1,o=sample1 -w test
ldap_simple_bind: Invalid credentials

ldapsearch -p 389 -D cn=root -w root  -s sub objectclass=* -b cn=test1,o=sample1 +ibmpwdpolicy
cn=test1,o=sample1
ibm-pwdIndividualPolicyDN=cn=noPwdPolicy
pwdFailureTime=20190630224644.627592Z

ldapmodify -p 389 -D cn=test1,o=sample1 -w test
ldap_simple_bind: Invalid credentials

ldapsearch -p 389 -D cn=root -w root  -s sub objectclass=* -b cn=test1,o=sample1 +ibmpwdpolicy
cn=test1,o=sample1
ibm-pwdIndividualPolicyDN=cn=noPwdPolicy
pwdFailureTime=20190630224644.627592Z
pwdFailureTime=20190630224650.169000Z

ldapmodify -p 389 -D cn=test1,o=sample1 -w test
ldap_simple_bind: Invalid credentials

ldapsearch -p 389 -D cn=root -w root  -s sub objectclass=* -b cn=test1,o=sample1 +ibmpwdpolicy
cn=test1,o=sample1
ibm-pwdIndividualPolicyDN=cn=noPwdPolicy
pwdFailureTime=20190630224644.627592Z
pwdFailureTime=20190630224650.169000Z
pwdFailureTime=20190630224814.431944Z

Behaviour after you apply IF 6.4.0.19

The behavior for recording pwdFailureTime for user accounts that are set to no lockout are now different. For such user accounts, on every bind failure attempt, the existing values of pwdFailureTime attribute are removed and recent time stamp entry is registered.

By using the same settings for global password policy and the user account in the earlier scenario, pwdFailureTime contains the following content:

ldapmodify -p 389 -D cn=test1,o=sample1 -w test
ldap_simple_bind: Invalid credentials

ldapsearch -p 389 -D cn=root -w root  -s sub objectclass=* -b cn=test1,o=sample1 +ibmpwdpolicy
cn=test1,o=sample1
ibm-pwdIndividualPolicyDN=cn=noPwdPolicy
pwdFailureTime=20190630230036.254184Z

ldapmodify -p 389 -D cn=test1,o=sample1 -w test
ldap_simple_bind: Invalid credentials

ldapsearch -p 389 -D cn=root -w root  -s sub objectclass=* -b cn=test1,o=sample1 +ibmpwdpolicy
cn=test1,o=sample1
ibm-pwdIndividualPolicyDN=cn=noPwdPolicy
pwdFailureTime=20190630230040.449923Z

ldapmodify -p 389 -D cn=test1,o=sample1 -w test
ldap_simple_bind: Invalid credentials

ldapsearch -p 389 -D cn=root -w root  -s sub objectclass=* -b cn=test1,o=sample1 +ibmpwdpolicy
cn=test1,o=sample1
ibm-pwdIndividualPolicyDN=cn=noPwdPolicy
pwdFailureTime=20190630230411.813454Z

With this change in behavior, the only recent time stamp entry is stored for user accounts.