Bug 20040 - FailedLoginAttempts syspref will lock out users so that they cannot log in unless the syspref is cleared
Summary: FailedLoginAttempts syspref will lock out users so that they cannot log in un...
Status: CLOSED WORKSFORME
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: 17.05
Hardware: All All
: P5 - low major (vote)
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on: 18314
Blocks:
  Show dependency treegraph
 
Reported: 2018-01-18 23:57 UTC by Barton Chittenden
Modified: 2019-11-06 13:52 UTC (History)
4 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Barton Chittenden 2018-01-18 23:57:29 UTC
I think that the FailedLoginAttempts system preference is only meant to be set ifNorwegianPatronDBEnable is set to 'Enable'; my testing is all done with ifNorwegianPatronDBEnable set to 'Disable'.

What's happening:

Setting FailedLoginAttempts, then logging in with incorrect credentials will lock the account. The login screen says that the account is locked, and no further attempts to log in will work.

It is entirely unclear how to unlock the account -- resetting the password does not work, and the lock is not set via borrower debarments, so it can't be disabled there.

The only way I was able to re-enable logins for a locked patron was to blank out FailedLoginAttempts.

If this is only meant to be used in conjunction with ifNorwegianPatronDBEnable, it shouldn't be settable unless that is enabled.
Comment 1 Katrin Fischer 2018-01-19 05:00:15 UTC
Hi Barton, the preference is not related to ifNorwegianPatronDBEnable. See here:
bug 18314

This login_attempts field is reset when a patron correctly logs in. When
the account is locked the patron has to reset his/her password using
the OpacResetPassword feature or ask a staff member to generate a new
password.
Comment 2 Katrin Fischer 2018-01-19 05:02:17 UTC
Not a blocker - feature can be turned off (workaround) and no data loss:
https://wiki.koha-community.org/wiki/Bug_Reporting_Guidelines#Severity
Comment 3 Jonathan Druart 2018-01-19 12:02:22 UTC
I have just quickly tested the feature on 17.05.x and everything works fine.
Please read the description on the bug report and try again :)

Changing the password unlock the account.
Comment 4 Jonathan Druart 2018-02-20 20:23:25 UTC
Looks invalid, please reopen if it is not.