User encounters CAPTCHA too frequently

[Erwin Manuel]

Hi, one of our users is frequently asked to enter a CAPTCHA even if he has no failed login.

We are using LDAP authentication. Any tips? Thanks.

[Joe Clark · Accepted solution]

The most common cause of CAPTCHAs like this is that the user has some other application (for example, an RSS Reader) that is trying to login to the application repeatedly with an old or expired password, failing, and triggering the CATPCHA limit.

[Anson Hoyt]

How would I go about finding the offending application? Are these login failures logged with useful details like referring host or IP address?

[Joe Clark]

Hi Anson,

You should try enabling HTTP Access logging on Confluence's tomcat server - http://tomcat.apache.org/tomcat-6.0-doc/config/valve.html#Access_Log_Valve

From here you may be able to identify a pattern of login failures, and this log will give you information such as remote IP and User Agent for all incoming requests.