PASSWORD_SECURITY_POLICY (MAX_FAILED_LOGIN_ATTEMPTS) also applies to LDAP-authenticated users
Details
| Detail name | Value |
|---|---|
| Changelog Number | 11718 |
| Type | Bug |
| Status | Resolved |
| Affected Versions | Exasol 7.0.0, Exasol 7.1.0, Exasol 8.0.0 |
| Fix Versions | Exasol 7.1.16, Exasol 8.9.0 |
| Resolution Date | 2022-11-24 |
Description
The PASSWORD_SECURITY_POLICY parameter MAX_FAILED_LOGIN_ATTEMPTS also applies to users logging in to Exasol using LDAP-based authentication. This can lead to such database users being locked if the configured maximum number of failed login attempts is exceeded due to any LDAP-related authentication failures such as providing the wrong login credentials or communication failures with the LDAP server.
Workaround
If the user is already locked, the login attempts can be reset by the following command:
ALTER USER "USER" RESET FAILED LOGIN ATTEMPTS
Fix
Password Security Policies do not apply to LDAP-authenticated users. LDAP-authenticated users will not be locked after exceeding the maximum failed login attempts.
Changed behavior
A Password Security Policy's maximum number of failed logins is no longer applied to database users who authenticate with LDAP and Kerberos.
