Bug 20040

Summary: FailedLoginAttempts syspref will lock out users so that they cannot log in unless the syspref is cleared
Product: Koha Reporter: Barton Chittenden <barton>
Component: AuthenticationAssignee: Bugs List <koha-bugs>
Status: CLOSED WORKSFORME QA Contact: Testopia <testopia>
Severity: major    
Priority: P5 - low CC: andrew, dpavlin, jonathan.druart
Version: 17.05   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:
Bug Depends on: 18314    
Bug Blocks:    

Description Barton Chittenden 2018-01-18 23:57:29 UTC
I think that the FailedLoginAttempts system preference is only meant to be set ifNorwegianPatronDBEnable is set to 'Enable'; my testing is all done with ifNorwegianPatronDBEnable set to 'Disable'.

What's happening:

Setting FailedLoginAttempts, then logging in with incorrect credentials will lock the account. The login screen says that the account is locked, and no further attempts to log in will work.

It is entirely unclear how to unlock the account -- resetting the password does not work, and the lock is not set via borrower debarments, so it can't be disabled there.

The only way I was able to re-enable logins for a locked patron was to blank out FailedLoginAttempts.

If this is only meant to be used in conjunction with ifNorwegianPatronDBEnable, it shouldn't be settable unless that is enabled.
Comment 1 Katrin Fischer 2018-01-19 05:00:15 UTC
Hi Barton, the preference is not related to ifNorwegianPatronDBEnable. See here:
bug 18314

This login_attempts field is reset when a patron correctly logs in. When
the account is locked the patron has to reset his/her password using
the OpacResetPassword feature or ask a staff member to generate a new
password.
Comment 2 Katrin Fischer 2018-01-19 05:02:17 UTC
Not a blocker - feature can be turned off (workaround) and no data loss:
https://wiki.koha-community.org/wiki/Bug_Reporting_Guidelines#Severity
Comment 3 Jonathan Druart 2018-01-19 12:02:22 UTC
I have just quickly tested the feature on 17.05.x and everything works fine.
Please read the description on the bug report and try again :)

Changing the password unlock the account.
Comment 4 Jonathan Druart 2018-02-20 20:23:25 UTC
Looks invalid, please reopen if it is not.