# \[FEATURE-1570\] User lockout feature **URL:** \ **Category:** Ignition\ **Created:** [December 3, 2019, 6:42pm UTC](https://forum.inductiveautomation.com/t/feature-1570-user-lockout-feature/30413 "2019-12-03T18:42:54Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![justin.brzozoski](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/justin.brzozoski/32/13452_2.png) [@justin.brzozoski](https://forum.inductiveautomation.com/u/justin.brzozoski)\ **Post date:** [December 3, 2019, 6:42pm UTC](https://forum.inductiveautomation.com/t/feature-1570-user-lockout-feature/30413/1 "2019-12-03T18:42:54Z")
We’re running Ignition 8.0.6. Users login to our Perspective projects through the built-in ID provider referencing back to a manual-mode user DB. One of our employees couldn’t login. He then asked an admin to reset his password, who did, but he was still unable to login. I came by 20+ minutes later and reset the password and he was able to login just fine. Looking back through the server log, I see lines like this around the time of his original login and the attempts just after the admin reset it: ```auto INFO | jvm 1 | 2019/12/03 17:28:00 | I [U.DB_ManualMode] [17:28:00]: User 'xxx' is now locked out route-group=authn, route-path=/submit-username-password-challenge/:client-id INFO | jvm 1 | 2019/12/03 17:31:53 | I [U.DB_ManualMode] [17:31:53]: User 'xxx' is locked out route-group=authn, route-path=/submit-username-password-challenge/:client-id INFO | jvm 1 | 2019/12/03 17:33:08 | I [U.DB_ManualMode] [17:33:08]: User 'xxx' is locked out route-group=authn, route-path=/submit-username-password-challenge/:client-id INFO | jvm 1 | 2019/12/03 17:34:11 | I [U.DB_ManualMode] [17:34:11]: User 'xxx' is locked out route-group=authn, route-path=/submit-username-password-challenge/:client-id ``` I found the lockout settings on the user DB page, and assume that must be what was going on. I’ve searched the manual and forums for more details on the lockout feature, but I’m not finding anything. Is there anything an admin could have done to reset the lockout period and allow him to login sooner? ---
**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\ **Post date:** [December 3, 2019, 7:23pm UTC](https://forum.inductiveautomation.com/t/feature-1570-user-lockout-feature/30413/2 "2019-12-03T19:23:06Z")
Hi @justin.brzozoski - The only way to immediately clear the lockout is to disable lockout on a user source profile and save. You can then immediately re-enable the lockout and save (if you wish to keep it enabled). This clears all current lockouts for all users for the user source profile. ---
**Author:** ![justin.brzozoski](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/justin.brzozoski/32/13452_2.png) [@justin.brzozoski](https://forum.inductiveautomation.com/u/justin.brzozoski)\ **Post date:** [January 11, 2021, 4:54pm UTC](https://forum.inductiveautomation.com/t/feature-1570-user-lockout-feature/30413/3 "2021-01-11T16:54:01Z")
There should be an entry in the audit log for a user lockout event. As of 8.1.0 there isn’t. ---
**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\ **Post date:** [January 14, 2021, 12:53am UTC](https://forum.inductiveautomation.com/t/feature-1570-user-lockout-feature/30413/4 "2021-01-14T00:53:06Z")
I added a ticket for auditing the moment a user becomes locked out. ---
**Author:** ![justin.brzozoski](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/justin.brzozoski/32/13452_2.png) [@justin.brzozoski](https://forum.inductiveautomation.com/u/justin.brzozoski)\ **Post date:** [July 14, 2021, 4:05pm UTC](https://forum.inductiveautomation.com/t/feature-1570-user-lockout-feature/30413/5 "2021-07-14T16:05:41Z")
There is no feedback to the user that login failures are due to a locked account. This is a poor UX. Can we add another feature to the backlog to fix that? ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [July 14, 2021, 4:11pm UTC](https://forum.inductiveautomation.com/t/feature-1570-user-lockout-feature/30413/6 "2021-07-14T16:11:42Z")
> [@justin.brzozoski](#): > > There is no feedback to the user that login failures are due to a locked account. This is a poor UX. This is security, which I'll grant you can be interpreted as poor UX. Leaking information about why a login attempt fails is bad practice. ---
**Author:** ![bkarabinchak.psi](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/bkarabinchak.psi/32/83567_2.png) [@bkarabinchak.psi](https://forum.inductiveautomation.com/u/bkarabinchak.psi)\ **Post date:** [March 18, 2022, 12:16pm UTC](https://forum.inductiveautomation.com/t/feature-1570-user-lockout-feature/30413/7 "2022-03-18T12:16:28Z")
Is this still the only way to disable a lockout for a single user - to make the disable lockout for the entire user source and then re-enable? Or is there a way to do it on an individual basis now? Not a big deal just curious. ---
**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\ **Post date:** [March 18, 2022, 4:04pm UTC](https://forum.inductiveautomation.com/t/feature-1570-user-lockout-feature/30413/8 "2022-03-18T16:04:04Z")
This is still the only way. We do have an internal ticket tracking an effort to add a user interface to view currently locked out users and unlock them on a more fine-grained basis (IGN-5298), but it has yet to be spec’d and designed, so it will probably be a while until it is fully implemented… ---
**Author:** ![johannes.bo](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/johannes.bo/32/27628_2.png) [@johannes.bo](https://forum.inductiveautomation.com/u/johannes.bo)\ **Post date:** [March 28, 2022, 11:27am UTC](https://forum.inductiveautomation.com/t/feature-1570-user-lockout-feature/30413/9 "2022-03-28T11:27:00Z")
- An interface in the gateway webpage is a minimum for this FR, Currently I need to guess why login fails… - A system tag pr user would be wonderful - A system.security.getLockStatus(user) would be second best (both would allow me to present relevant info in a admin dashboard) - lockUser(user), unlockUser(user) would be nice-to-have features j. ---
**Author:** ![bkarabinchak.psi](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/bkarabinchak.psi/32/83567_2.png) [@bkarabinchak.psi](https://forum.inductiveautomation.com/u/bkarabinchak.psi)\ **Post date:** [March 28, 2022, 12:05pm UTC](https://forum.inductiveautomation.com/t/feature-1570-user-lockout-feature/30413/10 "2022-03-28T12:05:11Z")
> [@johannes.bo](#): > > An interface in the gateway webpage is a minimum for this FR, Currently I need to guess why login fails… FWIW in the gateway logs it will tell you when a user get's locked out and what IP address the sign-in attempts came from - this helped me realize it was just from my employee's computer and not some outside source and so nothing to be too worried about. I agree with your other points though. A way to lock or unlock a single user instead of the user-source wholesale is definitely the right way to do this sort of thing. I imagine a case where one user is legitimately locked out due to an outside IP address trying to brute force a password, and another user just accidentally messed up a few times. I wouldn't want to unlock the first user, but would want to unlock the second user. ---
**Author:** ![jlandwerlen](https://avatars.discourse-cdn.com/v4/letter/j/bc8723/32.png) [@jlandwerlen](https://forum.inductiveautomation.com/u/jlandwerlen)\ **Post date:** [April 13, 2023, 2:51pm UTC](https://forum.inductiveautomation.com/t/feature-1570-user-lockout-feature/30413/11 "2023-04-13T14:51:39Z")
@jspecht any update on this ticket? From what I can see, unlocking is still only done by making a change to user source. ---
**Author:** ![justin.brzozoski](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/justin.brzozoski/32/13452_2.png) [@justin.brzozoski](https://forum.inductiveautomation.com/u/justin.brzozoski)\ **Post date:** [June 5, 2023, 4:25pm UTC](https://forum.inductiveautomation.com/t/feature-1570-user-lockout-feature/30413/12 "2023-06-05T16:25:01Z")
It's not 100% clear in the documentation: how long until a lockout automatically resets on it's own (w/o having to edit the user source)? ---
**Author:** ![jlandwerlen](https://avatars.discourse-cdn.com/v4/letter/j/bc8723/32.png) [@jlandwerlen](https://forum.inductiveautomation.com/u/jlandwerlen)\ **Post date:** [June 5, 2023, 4:37pm UTC](https://forum.inductiveautomation.com/t/feature-1570-user-lockout-feature/30413/13 "2023-06-05T16:37:27Z")
I don't think it ever automatically resets.