Uploaded image for project: 'Moodle'
  1. Moodle
  2. MDL-21342

Account lockout after failed login attempts

    XMLWordPrintable

Details

    • Any
    • MOODLE_20_STABLE, MOODLE_24_STABLE
    • MOODLE_25_STABLE
    • w51_MDL-21342_m25_lockout
    • Hide

      1/ run phpunit tests
      2/ set some low threshold and timeouts and try lockouts

      • verify user gets email with unlock instructions
      • verify account is unlocked automatically after selected time without failed logins
      • verify that more attempts in some longer window do not trigger lockout
      • verify admin may unlock accounts manually from the Admins / Users / Accounts / Browse list of users
      Show
      1/ run phpunit tests 2/ set some low threshold and timeouts and try lockouts verify user gets email with unlock instructions verify account is unlocked automatically after selected time without failed logins verify that more attempts in some longer window do not trigger lockout verify admin may unlock accounts manually from the Admins / Users / Accounts / Browse list of users

    Description

      Implement a lockout system for web services => when wrong password too many time, lock the user (except if IP restriction field is not empty)
      Maybe do an administration too to unlock and visualize locked
      nothing needed for token
      Specs needed.
      log needed when a lockout happens.

      Balsamiq Wireframes

        Attachments

          1. documentation_MDL-21342.pdf
            202 kB
          2. testingInstructions.pdf
            177 kB
          3. webservice lockout.bmml
            3 kB
          4. webservice lockout.png
            webservice lockout.png
            43 kB
          5. wslockoutadmin.png
            wslockoutadmin.png
            52 kB

          Issue Links

            caused a regression

            Bug - A problem which impairs or prevents Moodle from functioning correctly. MDL-37515 PHP Notice when submitting change password form

            • Minor - Minor loss of function where workaround is possible
            • Closed
            has a non-specific relationship to

            Improvement - An enhancement to an existing Moodle feature. MDL-37405 Consider backporting login lockout system to 2.4

            • Minor - Minor loss of function where workaround is possible
            • Closed
            has been marked as being related by

            Improvement - An enhancement to an existing Moodle feature. MDL-18339 Site policies: Allow site setting for maximum number of login attempts

            • Major - Major loss of function, incorrect output
            • Closed

            Activity

              People

                skodak Petr Skoda
                jerome Jérôme Mouneyrac
                Damyon Wiese Damyon Wiese
                Sam Hemelryk Sam Hemelryk
                Jason Fowler Jason Fowler
                David Woloszyn, Huong Nguyen, Jake Dallimore, Meirza, Michael Hawkins, Raquel Ortega, Safat Shahin, Stevani Andolo, David Woloszyn, Huong Nguyen, Jake Dallimore, Meirza, Michael Hawkins, Raquel Ortega, Safat Shahin, Stevani Andolo, Juan Leyva, David Woloszyn, Huong Nguyen, Jake Dallimore, Meirza, Michael Hawkins, Raquel Ortega, Safat Shahin, Stevani Andolo
                Votes:
                10 Vote for this issue
                Watchers:
                21 Start watching this issue

                Dates

                  Created:
                  Updated:
                  Resolved:
                  14/May/13