Skip to content

Commit

Permalink
[v13] docs: provide information on local user locks from login attemp…
Browse files Browse the repository at this point in the history
…ts (#27609)

* docs: provide information on local user locks from login attemps

* Update docs/pages/reference/authentication.mdx

Co-authored-by: Alex Fornuto <alex.fornuto@goteleport.com>

* header update

* Apply suggestions from code review

Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>

* user variable use

Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>

* verbiage change

* fix file reference

* Change to blocked instead of locked

* Correct words

---------

Co-authored-by: Alex Fornuto <alex.fornuto@goteleport.com>
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
  • Loading branch information
3 people authored Jun 8, 2023
1 parent c40a39d commit c3bf567
Showing 1 changed file with 44 additions and 0 deletions.
44 changes: 44 additions & 0 deletions docs/pages/reference/authentication.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -121,6 +121,50 @@ $ tctl create -f cap.yaml
</TabItem>
</Tabs>

### Local user login failure rules

A local user is blocked from attempting logins if, within a 30 minute window, a local user has multiple:

- failed login attempts or
- failed password resets

The block lasts 20 minutes. After the block has expired the user may attempt to log in again.

Overriding a block is available to users with rights to maintain `user` resources,
available in the built-in `editor` role. To turn off a block, update the user entry,
following these steps.

Retrieve the user entry so you can edit the status:

```code
$ tctl get users/<Var name="username" /> > user.yaml
```

The file `user.yaml` should resemble the following:

```yaml
kind: user
metadata:
name: jeff
spec:
roles:
- access
status:
is_locked: true
lock_expires: "2023-04-22T01:55:02.228158166Z"
locked_message: user has exceeded maximum failed login attempts
version: v2
```

Update the `is_locked` field under `status` to `false` and save the file. Now
update the user entry with the command below:

```code
$ tctl create -f user.yaml
```

The user will now be unblocked from login attempts and can attempt to authenticate again.

## Authentication connectors

<Tabs>
Expand Down

0 comments on commit c3bf567

Please sign in to comment.