User account gets locked

Edit online

When the pwdLockout attribute is set to true, the user account might get locked even if the number of invalid bind attempts is less than the pwdMaxFailure value.

A user account might get locked when all the invalid bind attempts are made within a specified time interval that is set in the pwdFailureCountInterval attribute. For example, the following attributes are set:

ibm-pwdPolicyStartTime=20070217044605Z
pwdInHistory=0
pwdCheckSyntax=1
pwdGraceLoginLimit=0
pwdLockoutDuration=0
pwdMaxFailure=3
pwdFailureCountInterval=0
passwordMaxRepeatedChars=0
pwdMaxAge=99
pwdMinAge=0
pwdExpireWarning=0
pwdMinLength=5
passwordMinAlphaChars=0
passwordMinOtherChars=0
passwordMinDiffChars=0
ibm-pwdPolicy=true
pwdLockout=false
pwdAllowUserChange=true
pwdMustChange=false
pwdSafeModify=false
ibm-pwdGroupAndIndividualEnabled=true

With this setting, if a user makes three invalid bind attempts, the user can still continue with bind attempts because the pwdLockout attribute is set to false.

However, pwdFailureTime is registered even when pwdLockout is false. Therefore, if a user does three invalid bind attempts with pwdLockout=false or pwdMaxFailure=0, pwdFailureTime logs one recent time stamp out of the consecutive authentication failures.

Set the pwdLockout attribute to true:

# idsldapmodify -D cn=RDN_value -w password
-p port_number -h host_name
dn:cn=pwdpolicy,cn=ibmpolicies
pwdLockout:true

Now, when the pwdLockout attribute is set to true, another two invalid bind attempts causes lockout of the user account. The lockout occurs because the invalid bind attempts made when pwdLockout=false is also taken into account according to the number of values in the pwdFailureTime attribute that are younger than pwdFailureCountInterval.