{"id":4711,"date":"2012-11-20T16:13:40","date_gmt":"2012-11-20T20:13:40","guid":{"rendered":"http:\/\/onlineappsdba.com\/?p=4711"},"modified":"2016-05-14T10:34:29","modified_gmt":"2016-05-14T14:34:29","slug":"your-account-is-locked-you-can-unlock-your-account-by-going-to-forgot-password","status":"publish","type":"post","link":"https:\/\/onlineappsdba.com\/index.php\/2012\/11\/20\/your-account-is-locked-you-can-unlock-your-account-by-going-to-forgot-password\/","title":{"rendered":"Your account is locked. You can unlock your account by going to Forgot Password"},"content":{"rendered":"

\"\"<\/a><\/p>\n

If you login to application protected by Oracle Access Manager<\/strong> (OAM for Single Sign-On\/SSO) and you see screen like above “Your account is locked. You can unlock your account by going to Forgot Password<\/strong><\/span>” , This error means your account is locked in Oracle Access Manager<\/strong> (OAM)<\/p>\n

Q: How OAM 11g treats account as locked ?<\/strong><\/p>\n

If value of user’s attribute obLockoutTime<\/strong> is set or value of obLoginTryCount<\/strong> is set to 5<\/strong> then OAM treats this account as locked.<\/p>\n

Q: How can an end user unlock account without contacting administrator (Self Service) ?<\/strong><\/p>\n

If OAM is integrated with Oracle Identity Manager (OIM) then clicking on Forgot Password<\/strong> link will take user to forgot password page<\/strong> in OIM. User can then answer challenge questions registered at time of first time login. After entering correct answer to challenge questions, OIM will reset password in OIM and also update password in LDAP (OID in this case) using LDAPSync<\/strong> (OIM should be configured with LDAPSync enabled<\/span>. More on LDAPSync<\/strong> here<\/a>, here<\/a>, and\u00a0here<\/a>). This process will also clear two attributes obLockoutTime<\/strong>, and obLoginTryCount<\/strong> (OAM will then treat account as unlocked<\/span>)<\/p>\n

Q: How can an OIM Administrator unlock account locked in OAM via OIM ?<\/strong><\/p>\n

Once user is locked in OAM (via two attributes obLockoutTime<\/strong> and obLoginTryCount<\/strong>), LDAP User Reconciliation Job <\/strong>in\u00a0OIM<\/strong> (that runs every 5 minutes) will bring user’s data in OIM and enable UNLOCK<\/strong> button next to this user (If you see LOCK<\/strong> button then user is not locked, If you see UNLOCK<\/strong> button that means user in Locked in OIM too<\/span>). Administrator can click on UNLOCK<\/strong> button next to user details.<\/p>\n

Note:<\/strong> If there is any problem with reconciliation job (LDAP User Reconciliation) then you can have a user that is locked in OAM but not in OIM. Workaround in such case is first LOCK the user from OIM and then UNLOCK again from OIM (This step should clear two attributes obLockoutTime<\/strong> and obLoginTryCount<\/strong> from OID)<\/span><\/p>\n

\"\"<\/a><\/div>\n
Q: How can an OID Administrator unlock account locked in OAM ?<\/strong><\/strong><\/div>\n
If you have access to Oracle Internet Directory<\/strong> (or LDAP server where OAM is connecting for User Store<\/span>) then Login to LDAP Server and clear value of below two attributes\u00a0\u00a0obLockoutTime<\/strong> and obLoginTryCount<\/strong> (Login again with password used earlier)<\/div>\n
If you don’t know OAM is configured to connect to which LDAP (or OID store) for username\/password validation then check\u00a0here<\/a>, here<\/a>, and here<\/a>\"\"<\/a><\/div>\n

Other issues related to Account Lockout in Oracle Stack (depending on how you login and how components are integrated with each other) are<\/p>\n