Versions Compared

Old Version 1

changes.mady.by.user Former user

Saved on

compared with

New Version Current

changes.mady.by.user Former user

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Multiexcerpt
MultiExcerptNameAccount Locking & Disabling Configuration

The instructions given on this page follow the recommended approach for account locking and account disabling in WSO2 Identity Server, which is to use the governance identity.mgt listener.

Prior to the WSO2 IS 5.2.0 release, this was configured in a different way. If you require documentation on the steps for the old method for backward compatibility, see the WSO2 IS 5.2.0 documentation.

  1. Ensure that the "IdentityMgtEventListener" with the orderId=50 is set to false and the "IdentityMgtEventListener" with the orderId=95 is set to true in the <IS_HOME>/repository/conf/identity/identity.xml file. 

    step2

    This is already configured this way by default. You can skip this step if you have not changed this configuration previously.

    Click to see the code blockxmlTip

    The properties that you configure in the <IS_HOME>/repository/conf/identity/identity-event.properties file are applied at the time of WSO2 Identity Server startup.

    Once you start the server, any consecutive changes that you do in the <IS_HOME>/repository/conf/identity/identity-event.properties file, will not be picked up.

  2. Start the Identity Server and log into the management console using your tenant credentials. 

    Alternatively, you can also use the IdentityGovernanceAdminService SOAP service to do this instead of using the management console UI. See for more information on how to invoke this SOAP service. If you are using the SOAP service to configure this, you do not need to follow the steps given below this note.

  3. Click Resident under Identity Providers found in the Main tab.
  4. Expand the Login Policies tab.

  5. Expand the Account Locking tab and select the Account Lock Enabled checkbox. Click Update to save changes. 

  6. To enable account locking for other tenants, log out and repeat the steps given above from onwards. 

...

Configuration

Description

Maximum Failed Login Attempts

This indicates the number of consecutive attempts that a user can try to log in without the account getting locked. If the value you entered is 2, the account is locked if the login attempt fails twice.

Lock Timeout Increment Factor

When

This indicates how much the account unlock timeout is incremented by after each failed login attempt. For example, according to the values configured in the above screen, when a user exceeds the specified limit

specified for

of 4 Maximum Failed Login Attempts, the account is locked for

5 minutes, which is the time specified in Account Unlock Time. If the

10 minutes. This account unlock timeout is calculated as follows.

Panel

Account unlock timeout = Configured Account Unlock Time * (Lock Timeout Increment Factor ^ failed login attempt cycles)

i.e.,

10 minutes = 5 * ( 2 ^ 1 )

Tip
titleTip

If you want to configure the Lock Timeout Increment Factor property via the file based configuration, the parameter you need to configure is account.lock.handler.login.fail.timeout.ratio.

If the user attempts to log in

again

with invalid credentials

,

again after the wait time has elapsed and the account

gets locked

is unlocked, the

wait time is 7 minutes (i.e., the Account Unlock Time in addition to the Lock Timeout increment Factor). In the event that the account gets locked again,

number of login attempt cycles is now 2 and the wait time is

9 minutes as this is incremented by the Lock Timeout Increment Factor again

20 minutes.

Account Unlock Time

The time specified here is in minutes. According to the values in the screenshot above, the account is locked for 5 minutes after the user's second failed attempt and authentication can be attempted once this time has passed.

Account Lock Enabled

This enables locking the account when authentication fails.

...