0

Introduction

A Magento2 site locks our admin user immediately after a single (ONE) incorrect login attempt.

The admin page will then give us this error message:

"The account sign-in was incorrect or your account is disabled temporarily. Please wait and try again later".

I understand then immediately that this user has been blocked.

To unlock the account, I then run:

bin/magento admin:user:unlock <AdminUser>

Issue

The problem is that several users use the same account which then might be caused by any of those people incorrectly inputting incorrect details for ONE single attempt. This then means a typing mistake causes all users that depend on this login to be blocked.

This happens on a Magento 2.3.5 and 2.3.7 installation.

Question

Where/How do I increase the failed attempts safely such that I can increase it to a more reasonable amount, but I don't want to completely disable this security feature.

1

Backend configuration is available for this:-

Store > Configuration > Advanced > Admin > Security > Maximum Login Failures to Lockout Account
3
  • Thank you, I will test it now. Interestingly, the 'default/global' value is 6 currently (input is locked), but obviously this values is being ignored at the moment... so I will override it and see if it actually applies now. Nov 15 '21 at 12:17
  • Thanks! It seems the 'default/global' value even when it is set visually, does not get used properly on a 'new' installation. Once I updated this and cleared cache, I got the same error message, however when I now login again (with correct information) it then 'auto-unlocks' the account again. Not really sure if the default behaviour works as intended.... Nov 15 '21 at 12:30
  • Most Welcome... :) Nov 15 '21 at 12:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.