When A User Account Is Locked Out, The Account Credentials Are Still Validated Against The Backend System (Doc ID 2029248.1)

Last updated on JULY 26, 2023

Applies to:

Goal

WebLogic has a concept of user lockouts in its security realm. That is, after a certain number of failed authentication requests, the user is locked out for a specified period of time. The customer would not expect any more traffic to be hitting the backend system (LDAP server, AD and so forth). An Oracle technical brief describes this behavior: "Once the account has been soft locked in WebLogic runtime, it does not try to validate the account credentials against the backend system, thus preventing it from being permanently locked" (Diagnosing Intermittent Authentication Failures and User Lock-Outs in Oracle WebLogic). However, even when a user account is soft locked in WebLogic runtime, account credentials are still validated against the back-end system.

Why is a locked account still authenticated against the backend system?

Solution

My Oracle Support provides customers with access to over a million knowledge articles and a vibrant support community of peers and Oracle experts.