AccountLockoutManagement

This interface provides a mechanism managing the Account Lockout feature supported by the Password login flow. It allows querying the state of an account, incrementing the lockout count (which could be used to lockout an account administratively), and clearing a lockout.

This is exposed via a simple REST API via an administrative flow located at the path /idp/profile/admin/lockout and access is blocked by default. Like all administrative features, you have the ability to customize authentication and access control.

To the base path you must append a slash, the name of a bean implementing the AccountLockoutManager interface, another slash, and finally the "key" that identifies the lockout record to access. By default this will be a username, a bang (!), and an IP address (unless you customize the way the lockout is scoped).

The default location of the lockout manager bean that is commented out by default is inside the password-authn-config.xml file. If you need to make use of this management API, move that bean (or copy it if you prefer) into global.xml so that it will be accessible to this feature.

Three HTTP methods are supported:

1. GET – query an account to see if it's locked or not
2. POST – increment an account's lockout counter artificially
3. DELETE – clear an account's lockout state

The POST/DELETE operations return a 204 on success, while the GET operation returns a JSON response describing the object queried and the lockout status. An example trace follows (much of the response header dump is elided, this just shows the basics).

$ curl -ik "https://localhost/idp/profile/admin/lockout/shibboleth.authn.Password.AccountLockoutManager/jdoe%21192.168.1.1"

HTTP/1.1 200 OK
Content-Type: application/json;charset=utf-8

{
  "data" : {
    "type" : "lockout-statuses",
    "id" : "shibboleth.authn.Password.AccountLockoutManager/jdoe!192.168.1.1",
    "attributes" : {
      "lockout" : true
    }
  }
}

$ curl -X DELETE -ik "https://localhost/idp/profile/admin/lockout/shibboleth.authn.Password.AccountLockoutManager/jdoe%21192.168.1.1"
HTTP/1.1 204 No Content

Reference

V4.0 and upgraded systems include a bean defined in conf/admin/general-admin.xml to control aspects of the flow's behavior.

V4.1 includes properties to control various aspects of the flow's behavior using an internally-defined bean that may be overridden if required.