Active Directory Account Lockout Threshold setting not being honored by IDP

[Marc Boorshtein]

I didn't think Active Directory counted LDAP BIND requests counted against
failed logins.  I thought it was only Kerberos requests that failed that
counted?


On Tue, Jul 23, 2013 at 11:29 AM, Yusuf Tran <Yusuf.Tran at kaplan.com> wrote:

>  Hi Guys,****
>
> ** **
>
> The problem is it appears as though each login request is actually 2 or x,
> x being the amount of idp nodes.****
>
> In active directory, the lockout threshold is 3, we intentionally want to
> lock the user out after 3 failed attempts, but they get locked out after 2!
> We increased the number to 10 to see what’s going on and it locks them out
> after 5, it appears as though there’s two requests per login try?****
>
> ** **
>
> This sounds strange and only affects our live environment as our dev and
> test IDP’s are not load balanced.****
>
> ** **
>
> I have the resolver in attribute-resolver.xml configured like so:****
>
> ** **
>
>     <resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"****
>
>         ldapURL="ldaps://192.168.148.134:636 ldaps://192.168.148.210:636"*
> ***
>
>         baseDN="ou=Students,dc=kicds,dc=com"****
>
>         principal="idp.ldap at kicds.com"****
>
>         principalCredential="areallygoodpassword!!!"****
>
>         connectionStrategy="ROUND_ROBIN">****
>
>         <dc:FilterTemplate>****
>
>             <![CDATA[****
>
>                 (sAMAccountName=$requestContext.principalName)****
>
>             ]]>****
>
>         </dc:FilterTemplate>****
>
>     </resolver:DataConnector>****
>
> ** **
>
> ** **
>
> login.config****
>
> ** **
>
>     <resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"****
>
>         ldapURL="ldaps://192.168.148.134:636 ldaps://192.168.148.210:636"*
> ***
>
>         baseDN="ou=Students,dc=kicds,dc=com"****
>
>         principal="idp.ldap at kicds.com"****
>
>         principalCredential="areallygoodpassword!!!"****
>
>         connectionStrategy="ROUND_ROBIN">****
>
>         <dc:FilterTemplate>****
>
>             <![CDATA[****
>
>                 (sAMAccountName=$requestContext.principalName)****
>
>             ]]>****
>
>         </dc:FilterTemplate>****
>
>     </resolver:DataConnector>****
>
> ** **
>
> I one login session and tailed the logs into a file, see attached, would
> appreciate the community’s input.****
>
> ** **
>
> ** **
>
> Regards****
>
> Yusuf****
>
> * *
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130723/d2e3e300/attachment.html