How to avoid user locking

[Former Member]

hi,

when a user tries to login but enters serveral time a wrong password the account get locked. is it possible to change this behaviour (I mean beside entering the right password) so that the account will not be locked?

kind regards

Michael

[Former Member · Accepted solution]

<u>login/fails_to_session_end</u>

Defines the number of unsuccessful logon attempts before the system does not allow any more logon attempts. The parameter is to be set to a value lower than the value of parameter login/fails_to_user_lock.

Default value: 3; permissible values: 1 -99

<u>login/fails_to_user_lock</u>

Defines the number of unsuccessful logon attempts before the system locks the user.

Default value: 5; permissible values: 1 -99

<u>login/failed_user_auto_unlock</u>

Defines whether user locks due to unsuccessful logon attempts should be automatically removed at midnight.

Default value: 0 (locks due to incorrect logon attempts remain in force for an unlimited period); permissible values: 0, 1

Thanks

Kalyan

[Former Member · Accepted solution]

hi,

can you please tell me where I have to set these values?

kind regards

Michael

[Former Member · Accepted solution]

Hi Michael,

I don’t think there a parameter which prevent locking users when wrong password is entered several times. But as the above post says you have a workaround. Set the parameter login/fails_to_user_lock to a high value. It can take a value from 1-99 , logically nobody will enter wrong password 99 times the same day

Every time the user enters a wrong password the counter is raised for that user’s master record. When the limit set by this parameter is surpassed, the user is locked. The lock becomes invalid at the end of the current day depending of login/failed_user_auto_unlock ‘s value ( if value is 1 lock is released at the end of the day )

You can put the value for login/fails_to_user_lock in default profile (RZ10 --> Defaulr.pfl --> change ) . But I don’t recommend doing this.This is a security violation , user id should get locked after entering wrong password few times. Then you can make sure that the system is being used by the right person and somebody cant login to the system by trial and error method.

The above procedure is for ABAP system .. I see you have posted this in JAVA forum, I am not sure about the Java procedure.

Thanks

Prince Jose