Repository navigation
Display temporary lock expiration time in the Admin Console #51637
DadouduckDoca
started this conversation in
Ideas
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Description
When brute force detection is enabled and a user is temporarily locked, the Admin Console currently displays the "Temporarily locked" status, but does not indicate when the lock will expire.
It would be useful for administrators to also see the date and time at which the temporary lock will end.
For example:
Temporarily locked: Yes
Locked until: Aug 12, 2026, 11:45 AM
Motivation
When investigating authentication issues or assisting a user who has been temporarily locked due to brute force protection, administrators currently have no indication in the Admin Console of how long the user will remain locked.
This information is particularly useful for support and operations teams, as it allows them to immediately tell whether the account is still locked and when access will be restored, without having to inspect the realm configuration or use additional API calls. This can significantly simplify incident handling and user support.
Administrators currently have to either:
know the realm brute-force configuration and manually determine the expected lock duration, or
query the Admin REST API.
However, the information is already available through the existing endpoint:
GET /admin/realms/{realm}/attack-detection/brute-force/users/{userId}
The response exposes the failedLoginNotBefore field, which represents the timestamp until which the user cannot log in.
For a temporary lock, the response can for example contain:
{
"disabled": true,
"failedLoginNotBefore": 1786527900
}
The Admin Console could therefore display this information without having to reproduce the brute-force lock duration calculation on the client side.
Expected behavior
When a user is temporarily locked, the Admin Console should display the lock expiration date/time next to, or below, the current "Temporarily locked" status.
For example:
Temporarily locked: Yes
Locked until: Aug 12, 2026, 11:45 AM
The value should be derived from failedLoginNotBefore and formatted according to the Admin Console locale/time zone conventions.
When the user is not temporarily locked, no expiration date needs to be displayed.
Additional context
failedLoginNotBefore is already exposed by the brute-force user status Admin REST API, so this enhancement should mainly concern its presentation in the Admin Console.
Related issue:
#17574 — Add failedLoginNotBefore field to existing brute force detection status API
All reactions