Rob Crittenden 560f2ce8bd Check for locked-out user before incrementing lastfail. ...

If a user become locked due to too many failed logins and then were
unlocked by an administrator, the account would not lock again. This
was caused by two things:

 - We were incrementing the fail counter before checking to see if the
   account was already locked out.
 - The current fail count wasn't taken into consideration when
   deciding if the account is locked.

The sequence was this:

1. Unlocked account, set failcount to 0
2. Failed login, increment failcount
3. Within lastfailed + lockout_duration, still locked. This skips
   update the last_failed date.

So I reversed 2 and 3 and check to see if the fail count exceeds policy.

https://fedorahosted.org/freeipa/ticket/2765

2012-05-18 09:03:22 +02:00

..

ipa-kdb

Check for locked-out user before incrementing lastfail.

2012-05-18 09:03:22 +02:00

ipa-sam

Add a second module init call for newer samba versions

2011-12-09 15:57:49 -05:00

ipa-slapi-plugins

Fix migration code password setting.

2012-05-17 17:17:42 +02:00

configure.ac

slapi-plugins: use thread-safe ldap library

2012-01-13 19:07:47 +02:00

ipa-version.h.in

Fix typos

2011-09-07 13:20:42 +02:00

Makefile.am

Add ipasam samba passdb backend

2011-12-06 08:29:53 -05:00