Active Directory Account Lockout Threshold setting not being honored by IDP

[Peter Schober]

* Yusuf Tran <Yusuf.Tran at kaplan.com> [2013-07-23 17:30]:
> In active directory, the lockout threshold is 3, we intentionally
> want to lock the user out after 3 failed attempts, but they get
> locked out after 2! We increased the number to 10 to see what's
> going on and it locks them out after 5, it appears as though there's
> two requests per login try?

Well, there's this error (though logged on DEBUG, not ERROR):

16:08:03.915 - DEBUG
[edu.vt.middleware.ldap.handler.DefaultConnectionHandler:163] - Error
connecting to LDAP URL: ldaps://192.168.148.134:636                                                               
javax.naming.AuthenticationException: [LDAP: error code 49 - 80090308:
LdapErr: DSID-0C0903A9, comment: AcceptSecurityContext error, data
52e, v1db1

where "80090308: LdapErr: DSID-0C0903A9, comment:
AcceptSecurityContext error, data 52e, v1db1" just seems to be MS-AD's
way of saying "LDAP return code 49".

Not sure why a wrong username or password would throw an exception
with a strack trace, but you have two of those "Error connecting"
messages, one for each configured LDAP server.

These are your "two requests per login", I would say.

> This sounds strange and only affects our live environment as our dev
> and test IDP's are not load balanced.

Too bad your test environment does not allow you to test things you
have in your production environment.
But I can't follow your "as our ..." reasoning. The IdP being load
balanced (or not) does not explain why one IdP would fail to connect
to an LDAP server (or two).
-peter