Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Description of problem:
After a number of (usually three) failed login attempts to an application server managed by a group of IDM/LDAP servers, the authentication server handling this user session locks the user account. But it does not replicate this lockout to other authentication servers in the domain. And so users experience inconsistent behavior during login, depending on which server handles any login attempt.
When the IdM infrastructure gets into this inconsistent state, the only fix is to check each IdM server, login as admin to any server where the user account is locked, and unlock it for that IdM server only.
Version-Release number of selected component (if applicable):
RHEL 7, RHEL 8
How reproducible:
At will
Steps to Reproduce:
1. Set up an IdM environment with a number of IdM servers. Set up a user account with a policy to lock that account after three login failures.
2. Try three times to login as that user with an incorrect password.
3. The IdM server handling the logins locks the user account.
4. The other IdM servers do not lock the user account.
Actual results:
See above - the IdM server handling the failed login attempts eventually locks the user account. But it does not replicate.
Expected results:
When an authentication server decides to lock a user account, *all* authentication servers in the domain should lock that user account.
Additional info:
The article at https://access.redhat.com/articles/3327351 makes a case that it's impractical to replicate login failure counts across authentication servers. Fair enough. However, it is still necessary to replicate actions such as account lockouts and password updates. Perhaps instead of replicating individual events, it might make sense to replicate overall state periodically. This is how other domain authentication systems handle these situations.
Seems like a duplicate of https://bugzilla.redhat.com/show_bug.cgi?id=971087
Lockout is calculated based on failed logins over a period of time. This requires the number of failed attempts to be replicated.
I just looked at that other bugzilla - it's more than 6 years old!
> Lockout is calculated based on failed logins over a period of time. This requires the number of failed attempts to be replicated.
So maybe don't replicate every failure attempt. When one server decides to lock an account, replicate what you need so all IdM servers are up to date. Or maybe don't replicate events, other than a few important ones like password updates. Instead of replicating individual events, maybe replicate an overall state periodically.
However you do it, we can't force admins to manually check every single IdM server to find the one that locks a user. Other domain authentication systems handle this issue automatically. IdM should too.
Once the upstream community implements this feature (https://pagure.io/freeipa/issue/8250) it will be pulled into a corresponding Red Hat Enterprise Linux release following the corresponding schedules.
From now on this issue will be tracked in the community issue tracker only.
Closing this BZ.