No bean of the correct type found named shibboleth.authn.Password.AccountLockoutManager

[Peter Schober]

I'm having trouble unlocking a locked account using the documented
URLs as per https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1294074654/AccountLockoutManagement
Affected IDP is 4.1.2, not upgraded from earlier versions, AFAIK.

curl -i 'http://localhost/idp/profile/admin/lockout/shibboleth.authn.Password.AccountLockoutManager/uid%21ipaddress'
HTTP/1.1 404
[...]
{
  "errors" : [ {
    "status" : "404",
    "title" : "Invalid Lockout Manager",
    "detail" : "Invalid lockout manager identifier in path."
  } ]
}

The 404 is clear enough and the process log has this to add:

  2022-03-22 13:57:45,626 - 127.0.0.1 - WARN
  [net.shibboleth.idp.authn.impl.DoLockoutManagerOperation:262] -
  Profile Action DoLockoutManagerOperation: No bean of the correct type
  found named shibboleth.authn.Password.AccountLockoutManager

But I don't know why it wouldn't find that bean (or why its type would
be wrong, for that matter): The lockout feature has been enabled in
conf/authn/password-authn-config.xml -- probably by just uncommenting
the existing bean going by that name:

  <bean id="shibboleth.authn.Password.AccountLockoutManager"
      parent="shibboleth.StorageBackedAccountLockoutManager"
      p:maxAttempts="5"
      p:counterInterval="PT5M"
      p:lockoutDuration="PT5M"
      p:extendLockoutDuration="false" />

An appropriate "idp.lockout.accessPolicy = AccessByIPAddress" has been
set in conf/admin/admin.properties and a policy by that name exists in
conf/access-control.xml (by default, IIRC) and access is allowed
(i.e., it's not HTTP 403).

So a bean by that name exists and matches the bean from the URL above
that was copied straight out of the wiki. Any ideas what's wrong here?
The IDP has been restarted so I'd claim that this is the active
configuration.

Thanks,
-peter