Forum Discussion

Richard_Cowell's avatar
Richard_Cowell
Icon for Nimbostratus rankNimbostratus
Dec 11, 2019

AD Account Lockout

We are using a RADIUS auth with an AD Query for user access. We have set the user to be allowed 2 attempts to login. This is 1 less than out AD lockout policy. IF the user attempts to login in 2 different sessions there have been 3 incorrect attempts (4 in total) and so AD account is locked. Is it possible to not allow the same credentials to be used in different sessions and stop the lockout. I did think about using Brute Force checking but we are not licensed for that. We are running 12.1.2 HF1

Thanks

  • Yoann_Le_Corvi1's avatar
    Yoann_Le_Corvi1
    Icon for Cumulonimbus rankCumulonimbus
    Dec 11, 2019

    Hi

     

    You should be able to achieve what you want with tables : https://clouddocs.f5.com/api/irules/table.html

     

    You would just need to determine the decision algorithme.

     

    You could for example :

    • Create an entry in the table when a new session is started storing the username and mrh session
    • When a new connexion is initiated, if an entry already exist, then drop the connexion
    • When the APM session is established or completely denied, delete the entry in the table to avoid memory issues.

    That's just an example.

     

    Also another way using the default settings of APM policy :

    • Max Sessions per User
    • Max InProgress Session per Client IP.

     

    It's less flexible than tables, but less devops also :)

     

    Yoann