# OpenAM Administration Guide
2.2.5. Hints For the Core Authentication Module

Sidebar | Prev | Up | Next

#### 2.2.5.4. Core - Account Lockout

This section of the Core Authentication module includes details on how account lockouts can be configured.

Login Failure Lockout Mode

  Selecting this attribute enables a physical lockout. Physical lockout will inactivate an LDAP attribute (defined in the Lockout Attribute Name property) in the user's profile. This attribute works in conjunction with several other lockout and notification attributes.

  ssoadm attribute: `iplanet-am-auth-login-failure-lockout-mode`

Login Failure Lockout Count

  Defines the number of attempts that a user has to authenticate, within the time interval defined in Login Failure Lockout Interval, before being locked out.

  ssoadm attribute: `iplanet-am-auth-login-failure-count`

Login Failure Lockout Interval

  Defines the time in minutes during which failed login attempts are counted. If one failed login attempt is followed by a second failed attempt, within this defined lockout interval time, the lockout count starts, and the user is locked out if the number of attempts reaches the number defined in Login Failure Lockout Count. If an attempt within the defined lockout interval time proves successful before the number of attempts reaches the number defined in Login Failure Lockout Count, the lockout count is reset.

  ssoadm attribute: `iplanet-am-auth-login-failure-duration`

Email Address to Send Lockout Notification

  Specify one (or more) email address(es) to which notification is sent if a user lockout occurs.

  Separate multiple addresses with spaces, and append `|`locale`|`charset`` to addresses for recipients in non-English locales.

  ssoadm attribute: `iplanet-am-auth-lockout-email-address`

Warn User After N Failures

  The number of authentication failures after which OpenAM displays a warning message that the user will be locked out.

  ssoadm attribute: `iplanet-am-auth-lockout-warn-user`

Login Failure Lockout Duration

  Defines how many minutes a user must wait after a lockout before attempting to authenticate again. Entering a value greater than 0 enables memory lockout and disables physical lockout. Memory lockout means the user's account is locked in memory for the number of minutes specified. The account is unlocked after the time period has passed.

  ssoadm attribute: `iplanet-am-auth-lockout-duration`

Lockout Duration Multiplier

  Defines a value with which to multiply the value of the Login Failure Lockout Duration attribute for each successive lockout. For example, if Login Failure Lockout Duration is set to 3 minutes, and the Lockout Duration Multiplier is set to 2, the user is locked out of the account for 6 minutes. Once the 6 minutes has elapsed, if the user again provides the wrong credentials, the lockout duration is then 12 minutes. With the Lockout Duration Multiplier, the lockout duration is incrementally increased based on the number of times the user has been locked out.

  ssoadm attribute: `sunLockoutDurationMultiplier`

Lockout Attribute Name

  Defines the LDAP attribute used for physical lockout. The default value is `inetuserstatus`, although the field in the OpenAM console is empty. The Lockout Attribute Value field must also contain an appropriate value.

  ssoadm attribute: `iplanet-am-auth-lockout-attribute-name`

Lockout Attribute Value

  Specifies the action to take on the attribute defined in Lockout Attribute Name. The default value is `inactive`, although the field in the OpenAM console is empty. The Lockout Attribute Name field must also contain an appropriate value.

  ssoadm attribute: `iplanet-am-auth-lockout-attribute-value`

Invalid Attempts Data Attribute Name

  Specifies the LDAP attribute used to hold the number of failed authentication attempts towards Login Failure Lockout Count.

  ssoadm attribute: `sunAMAuthInvalidAttemptsDataAttrName`

Store Invalid Attempts in Data Store

  Enables the storage of information regarding failed authentication attempts as the value of the Invalid Attempts Data Attribute Name in the user data store. In order to store data in this attribute, the OpenAM schema has to be loaded. Information stored includes number of invalid attempts, time of last failed attempt, lockout time and lockout duration. Storing this information in the identity repository allows it to be shared among multiple instances of OpenAM.

  ssoadm attribute: `sunStoreInvalidAttemptsInDS`