Hi Tom,

>Confluence never queries AD for account lock out information. If AD has decided that an account is locked out, then a Confluence user can't try any more passwords - presumably even the right password will be denied, or have I misunderstood how AD works?

You have uderstood AD correctly, if user makes five or more wrong account entries, AD lock the account.

Locked out account before opening browser:
The case here is that if user has locked out the account before opening the browser and went to the log in page the access to the Confluence is denied.

Open account before opening browser:
But if user hasn't locked the account before opening the browser and went to the log in page, user can try to guess the password countless times and if the user gets lucky and guess the password, say like on 35th guess, the access is granted to the Confluence.

Locked account after opening browser:
If user didn't guess the password, say on 35th times and closes the browser and opens the browser again and submits the right account information, the access to the Confluence is denied (this is because the AD has locked the account).

Ideal configuration would be that when user pushes the Log In button, information would sync with AD just like the browser was opened as a first time.

Thanks for the update.

Confluence never queries AD for account lock out information. If AD has decided that an account is locked out, then a Confluence user can't try any more passwords – presumably even the right password will be denied, or have I misunderstood how AD works?

What behaviour do you see for a locked out account before and after closing your browser?

Tom

Hi Tom,

I mean that Confluence synchronizes with AD when for example the browser window is closed, but doesn't sync if just a tab is closed and opened again.

Confluence does update the bad password information to AD in real time, but AD doesn't update the bad password information to Confluence (e.g. If the account is locked after 5 wrong entries). This causes threat issue because if attacker knows confluence-administrators user name (from example when pushing Contact Administrators link and moving mouse pointer above administrators name, the un shows at the status bar).

But I have tested that the problem disappears when I close whole browser window and open a new one and go to the log in page again. Closing just a tab (in mozilla) doesn't update the information. I still doesn't have to restart the server to get AD sync with Confluence.

Regards,
Petteri

Hi Petteri,

Can you please explain what you mean when you say "The problem disappears when session is restarted (meaning the browser session, not server session)"

Thanks,
Tom