Repository navigation
Replies: 2 comments
|
In case of openldap, when one enables the ppolicy overlay, one can use the pwdAccountLockedTime for the same purpose. It would be really useful to do a general solution for detecting the lockout when there is an ldap federation configured in keycloak. |
0 replies
|
In the context of passwordless passkeys, I believe this topic has become even more relevant. See, for example, the following issue: !23069 |
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Active Directory defines the lockoutTime attribute which is used to implement user lockout. When the user logs in via LDAP, there is no need for any special handling of that attribute at the Keycloak end (because LDAP bind would fail in that case).
However, if the user logs in using alternate methods (e.g. passkeys, FIDO etc.), the AD locked-out status won't be honored. Thus, if the user gets locked out via another channel, Keycloak login would still be possible.
Should we consider supporting the AD lockoutTime attribute natively?
All reactions