freeipa

#9742 Log then a user attempts to authenticate using LDAP but is locked out due to policy
Closed: fixed by sumenon. Opened by rcritten.

Closed: fixed
Reopen Issue

Request for enhancement

As an administrator I want logs to know what users have enough authentication failures to result in a lock out.

The KDC logs locked out authentication requests with "Client's credentials have been revoked"

The ipa-lockout plugin only rejects the login with no log as to the reason. This can make it difficult for administrators to track what is happening.

I don't want to log in the error log all failed authentications. That is already stored in the access log. What I'd add is a message when a user is locked out that another failed login attempt happened.

So if the password policy has max failures as 6 then on the 7th and beyond attempt something will be logged to the errors log until either the user is manually unlocked or the lockout duration is exceeded.

PR https://github.com/freeipa/freeipa/pull/7681

master:

  • dfcc25525ac8f2be4a5ecd8b7bcac8f282b9c4cd Log failed auth attempts over LDAP when a user is locked

ipa-4-12:

  • fbdf7551de524d4509c77f03bcb59d9b616c179f Log failed auth attempts over LDAP when a user is locked

Metadata Update from @sumenon:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
Normal
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.