This documentation is for WSO2 Identity Server 5.4.0. View documentation for the latest release.
Page Comparison - Account Locking by Failed Login Attempts (v.13 vs v.14) - Identity Server 5.4.0 - WSO2 Documentation

Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Configuration

Description

Maximum Failed Login Attempts

This indicates the number of consecutive attempts that a user can try to log in without the account getting locked. If the value you entered is 2, the account is locked if the login attempt fails twice.

Lock Timeout Increment Factor

This indicates how much the account unlock timeout is incremented by after each failed login attempt. For example, according to the values configured in the above screen, when a user exceeds the specified limit of 4 Maximum Failed Login Attempts, the account is locked for 10 minutes. This account unlock timeout is calculated as follows.

Panel

Account unlock timeout = Configured Account Unlock Time * (Lock Timeout Increment Factor ^ failed login attempt cycles)

i.e.,

10 minutes = 5 * ( 2 ^ 1 )

Tip
titleTip

If you want to configure the Lock Timeout Increment Factor property via the file based configuration, the parameter you need to configure is account.lock.handler.login.fail.timeout.ratio found in the <IS_HOME>/repository/conf/identity/identity-event.properties file.

If the user attempts to log in with invalid credentials again after the wait time has elapsed and the account is unlocked, the number of login attempt cycles is now 2 and the wait time is 20 minutes.

Account Unlock Time

The time specified here is in minutes. According to the values in the screenshot above, the account is locked for 5 minutes after the user's second failed attempt and authentication can be attempted once this time has passed.

Account Lock Enabled

This enables locking the account when authentication fails.

...