Active Directory Account Lockout Threshold setting not being honored by IDP

[Yusuf Tran]

Hi Guys,

The problem is it appears as though each login request is actually 2 or x, x being the amount of idp nodes.
In active directory, the lockout threshold is 3, we intentionally want to lock the user out after 3 failed attempts, but they get locked out after 2! We increased the number to 10 to see what's going on and it locks them out after 5, it appears as though there's two requests per login try?

This sounds strange and only affects our live environment as our dev and test IDP's are not load balanced.

I have the resolver in attribute-resolver.xml configured like so:

    <resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"
        ldapURL="ldaps://192.168.148.134:636 ldaps://192.168.148.210:636"
        baseDN="ou=Students,dc=kicds,dc=com"
        principal="idp.ldap at kicds.com"
        principalCredential="areallygoodpassword!!!"
        connectionStrategy="ROUND_ROBIN">
        <dc:FilterTemplate>
            <![CDATA[
                (sAMAccountName=$requestContext.principalName)
            ]]>
        </dc:FilterTemplate>
    </resolver:DataConnector>


login.config

    <resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"
        ldapURL="ldaps://192.168.148.134:636 ldaps://192.168.148.210:636"
        baseDN="ou=Students,dc=kicds,dc=com"
        principal="idp.ldap at kicds.com"
        principalCredential="areallygoodpassword!!!"
        connectionStrategy="ROUND_ROBIN">
        <dc:FilterTemplate>
            <![CDATA[
                (sAMAccountName=$requestContext.principalName)
            ]]>
        </dc:FilterTemplate>
    </resolver:DataConnector>

I one login session and tailed the logs into a file, see attached, would appreciate the community's input.


Regards
Yusuf

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130723/d15255b3/attachment-0001.html 
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: AccountLockoutTroubleshooting-single-login-request.txt
Url: http://shibboleth.net/pipermail/users/attachments/20130723/d15255b3/attachment-0001.txt