freeipa

#9937 Unused lockout period for determining user lockout
Closed: wontfix by dhanina. Opened by dhanina.

Closed: wontfix
Reopen Issue

Lockout period is unused when determining user lockout using pwpolicy.

Initially found during: https://github.com/freeipa/freeipa/pull/8147/changes/BASE..a8a76bafb97e7d5ce77b458e9ab069445e0fd8d3#r2761315456

Unrelated to this, but the calculation for is-locked is incorrect. There is a lockout period that isn't considered, nor lockout duration of 0.

The equivalent code from ipa_lockout.c:

if (failedcount >= max_fail) {
        if ((lockout_duration == 0) ||
            (time_now < timegm(&tm) + lockout_duration)) {
            /* Within lockout duration */
            goto done;
        }
 }
if (time_now > timegm(&tm) + failcnt_interval) {
        /* Not within lockout duration, outside of fail interval */
        failedcount = 0;
    } 
}

The current code is as follows:

if (user.krbloginfailedcount[0] >= max_failure) {
                that.state.push('is-locked');
}

This is also happening in the modern WebUI. I created an issue to track this: https://github.com/freeipa/freeipa-webui/issues/1068

Will be fixed only in Modern WebUI

Metadata Update from @dhanina:
- Issue close_status updated to: wontfix
- Issue status updated to: Closed (was: Open)
Metadata
None

webui

None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.