Configuring the Account Lockout Policy for Users

RapidIdentity Platform Documentation
Solution
Application
Content Type
Technical Documentation
Utilities & Services
ft:locale
en-US

RapidIdentity protects user accounts against account takeover attacks by automatically locking the account after five unsuccessful authentication attempts in 5 minutes. A locked account requires a delegate, such as a teacher, manager, or administrator, to unlock it.

The account lockout policy is configured on a password policy in RapidIdentity, but it applies to authentication attempts in general, not just password authentications. All RapidIdentity systems have a default password policy that includes a default account lockout policy. The policy applies to all users that are not associated with an administrator-defined password policy.

When a user is associated with more than one password policy, RapidIdentity applies the most restrictive policy. The same is true for authentication policies. However, authentication policies do not apply to the authentications created by the single sign-on extension with Seamless Learning Access.

Requirements

Access to your RapidIdentity administrator portal

  1. Navigate to your RapidIdentity administrator portal.
  2. From the module selector, choose "Configuration".
  3. In the Policies section, click Password.
  4. Open the password policy to edit.

    • To edit the Default Password Policy, click Edit next to it.

    • To edit an existing administrator-created policy that applies to Seamless Learning Access users, click the ellipsis next to the policy and select Edit.

    • To create a new policy for Seamless Learning Access users, click Add Policy.

  5. Click the Account Lockout Policy tab.
  6. Configure the following fields:
    FAILED ATTEMPTS
    The number of unsuccessful authentication attempts allowed before the account is locked. The default value is 5.
    WITHIN
    The time period in which the failed attempts are counted. The default value is 5 minutes.
    AUTOMATICALLY UNLOCK AFTER
    The amount of time RapidIdentity waits before automatically unlocking the account.
    Best Practice:

    To balance security with the user experience, leave FAILED ATTEMPTS set to the default value of 5, leave WITHIN set to the default value of 5, and set AUTOMATICALLY UNLOCK AFTER to no less than 15 Minutes.

  7. Click Save.

The account lockout policy applies to all users associated with the password policy.