lx1mf (lx1mf) asked a question.
Event outcome result consistency for user.account.lock events
Hi, sorry if this was asked before;
I was wondering what is the reasoning behind the outcome.result given in the two possible user.account.lock events. It seems like the user.account.lock events returns an outcome.result FAILURE, which is to be expected, but the user.account.lock.limit returns an outcome.result SUCCESS when it triggers in our systems.
If this is expected behavior, could you please explain the reasoning behind the distinct outcome results? I would expect that a user action (such as locking their account by attaining the limit) also be considered a FAILURE.
Image is not available
@lx1mf (lx1mf)
could you check this document:
https://developer.okta.com/docs/reference/api/event-types/#catalog
user.account.lock
Auto-lock user account for Okta.
user.account.lock.limit
This event is fired when a user account has reached the lockout limit. The account will not auto-unlock and a user or client cannot gain access to the account. This event indicates an account that will not be able to log in until remedial action is taken by the account admin. This event can be used to understand the specifics of an account lockout. Often this indicates a client application that is repeatedly attempting to authenticate with invalid credentials such as an old password.
Hi @a0n5s (a0n5s) , yes I have read the catalog and the event definition.
The catalog is fairly brief in describing events in themselves, there is no example event output from which to get information to corroborate.
Can you explain why an event that is 'indicating an account that will not be able to log in until remedial action is taken by the account admin' is triggered as outcome.result SUCCESS ? (see image provided in my initial comment)
Hi @lx1mf (lx1mf) Sorry, I search user.account.lock.limit in our test environment, I can't find any log. maybe you can create case with support and let they clarify.
No worries. If you didn't know you can simulate this event yourself by locking an account multiple times in succession. The user 'flow' I've seen for this to occur involves the auto-unlock mechanism that happens after an account is locked for invalid attempts.
Flow:
User Locks Account ==> User does not unlock himself, abandons logging in ==> Okta auto-unlocks account after a set period (10min, also a config I think). (==> Flow restarts)
If you repeat this flow, after 5 times (or so) you will trigger the user.account.lock.limit event, which from my understanding serves as a distinct lock event indicating there will no longer be any auto-unlocking done by Okta, only via manual admin intervention.