User profile lock out for 3 unsuccessful login attempts

[aahitha2]

Hi All,

1) Requirement1 :

I have on requirement that if user enters 3 time wrong password in LOGIN.DO page user profile should lock out.Currently i find one OOB script to lock user profile and its working for LOGIN.DO page.

var gr = new GlideRecord("sys_user");
gr.addQuery("user_name", event.parm1.toString());
gr.query();
if (gr.next()) {
gr.failed_attempts += 1;
if (gr.failed_attempts > 2) {
gr.locked_out = true;
gr.update();
gs.log("User " + event.parm1 + " locked out due to too many invalid login attempts");
session.addErrorMessage("Your account has been locked due to unsuccessful login attempts. Please contact your Service Desk for further assistance.");
} else {
gr.update();
}
}

2).Requirement 2: 

once user logged into service and he will try change password for that he will navigate to change password module( password Reset->Change password) he he needs to enter old password and new password and old password.

Issue: If USER enter old password 3 times wrong from change password form user profile ls locking out and instance is logging out.And above session error message is displaying while locking out.

for both LOGIN.DO and change module OOB SNC LOCK out script working.i dnt want to lock the user from change module form if users enters 3 wrong passwords.only from LOGIN.DO page user should lock out.How can i acheive this please.

Can any one help me.

Thanks,

Aahitha

[Ankur Sharma]

Hi Aahitha,

Have a look at these documents:

Specify lockout for failed login attempts

Logout (LogoutRequest) process flow

Let me know if it helps.

[aahitha2]

Hi Ankur,

I have modified SNC Lockout scripts as per document and working for LOGIN.DO page same logic working for Change password from also if i will gove 3 time worng pasword while am changing password user profile is locking.i want lock out functionality only for LOGIN.DO page.

Thanks,

Aahitha

[Ankur Sharma]

Hi Aahitha,

You can configure this password rest system property 'password_reset.request.max_attempt'. Default value is 3. 

Have a look at this document: Configure Password Reset properties

Let me know if it helps.