Configuring and managing failed user login attempts in Studio Server

Info: This feature requires Studio Server 10.70.0 or higher.

For security reasons, users should be blocked from continuously attempting to log in to Studio Server.

By default, Studio Server 10.70.0 or higher locks out a user after 3 failed login attempts. After these attempts, their number of logins needs to be reset by a system administrator.

How this is configured and managed is described in this article.

Note: This process does not apply to users who log in using Single Sign-On (SSO).

Configuration

The default behavior is as follows:

• The maximum number of attempts for a user to try to log in before they are locked out is 3 times.
• There is no delay between the number of attempts.

To change this behavior, the following settings can be added to the config_overrule.php file:

• LOGIN_MAXIMUM_ATTEMPTS. For defining the maximum number of login attempts before a user is locked out.

Notes:  Setting the number of attempts to 0 means that the user cannot log in at all. It is not possible to set an infinite number of login attempts.

• LOGIN_BACKOFF. For defining the time (in seconds) that should pass before a next login may be attempted.
  

Managing

Users that have reached the maximum number of login attempts are blocked from further attempts. For these users, their login attempts needs to be reset.

This is done on the User Maintenance page for that user.

Step 1. Access the User Maintenance page for the user.

Step 2. Next to Unblock User Login, click Unblock and confirm the action.