OpenLDAP accounts don't lock after failed JIRA login attempts

[Justin Carter]

Hi, I have set up a delegated LDAP authentication directory and I am now able to authenticate to JIRA using LDAP credentials.  I am (unsuccessfully) trying to get it so that OpenLDAP accounts lock after a certain number of failed JIRA login attempts.

I have configured ppolicy on the LDAP side, and the lockout mechanism works correctly if I try to login incorrectly to one of our other systems that are integrated with LDAP (OS authentication and subversion authentication).  On the LDAP side I get a new "pwdFailureTime" operational attribute for each failed login attempt, and then on the 5th failed attempt I get a "pwdAccountLockedTime" attribute.

But with JIRA I only get more and more "pwdFailureTime" attributes with each failed login attempt and the "pwdAccountLockedTime" attribute never appears.

Can anyone help?  Thanks very much.

Justin

[Niclas Sandstroem · Accepted solution]

Hi!

Could it be that pwdAccountLockedTime is not triggered due to Captcha?

https://jira.atlassian.com/browse/JRA-34557

https://confluence.atlassian.com/adminjiraserver073/configuring-jira-application-options-861253962.html

https://answers.atlassian.com/questions/221153

There is also plugins enabling more advanced behaviour if you run out of options.

[Justin Carter]

Thanks very much, your suggestion led me down the right path!  It was in a way related to the captchas.  The failed login attempts were getting expired in LDAP after 30 seconds.  So I didn't realize it, but I had to have 5 failed login attempts within the span of 30 seconds in order to lock the account, and the captchas were causing me to take longer than that.

[Niclas Sandstroem]

Glad I could help Justin please accept the answer if you feel it's appropriate. Also could you elaborate what you did? Did you increase the amount of tries before Captcha?

[Justin Carter]

Sorry, Atlassian wouldn't let me respond because I don't have enough points to make more than a couple comments per day.

Yes, for testing I increased the amount of tries before captcha to 100 and then I was able to lock the account.  Then once I figured out that it was possible to lock the account I found the OpenLDAP ppolicy setting pwdFailtureCountInterval and set it to 0 (changed from 30) so that failed attempts don't expire after 30 seconds and 5 consecutive failed attempts will lock the account, no matter how long apart they are. Then I lowered the captcha setting back to its original value of 3.

[Niclas Sandstroem]

That sounds great I will try to bump your points little