Github/authentik
1
0
Fork 0
mirror of https://github.com/goauthentik/authentik.git synced 2026-08-30 18:51:39 -07:00
Code Issues Packages Projects Releases Wiki Activity

website/docs: document password lockout

Browse Source
This commit is contained in:
Dominic R
2026-08-18 12:23:16 -04:00
parent 95d9519f57
commit ffb7d46199
2 changed files with 23 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
website/docs/add-secure-apps/flows-stages/stages/password/index.mdx
View File

@@ -17,10 +17,31 @@ The stage supports authentik's built-in password database, app passwords, LDAP-b
- **User database + app passwords**
- **User database + LDAP password**
- **User database + Kerberos password**
- **Failed attempts before cancel**: how many failed password submissions are allowed before the flow is canceled.
- **Failed attempts before cancel**: how many failed password submissions are allowed before the flow is canceled. This only ends the flow; the user can restart the flow immediately.
- **Failed attempts before lockout** :ak-enterprise Lock password login after this many consecutive failed attempts, until an administrator unlocks it. Failed attempts against LDAP and Kerberos backends are not counted. Set this option to `0` to disable lockout.
- **Last-attempt warning message** :ak-enterprise Warning shown when the user has one attempt remaining. Leave this blank to show no warning.
- **Lockout message** :ak-enterprise Message shown when the user's password has been locked. Leave this blank to show a generic authentication error instead.
- **Allow show password**: show a button that reveals the entered password.
- **Configuration flow**: optional authenticated flow that lets users configure or change their password from user settings.
## Password lockout :ak-enterprise {#password-lockout}
Set **Failed attempts before lockout** to a value above `0` to lock password login after that many consecutive failed attempts. A locked password is refused even when the correct password is submitted.
The count is per user and survives across flows and sessions, including password validation embedded in an Identification stage. A successful password validation resets it. Failed LDAP and Kerberos authentication is not counted because authentik cannot distinguish a wrong password from an unavailable external source.
By default, the flow reports the same error for a locked password and a wrong password. Set a **Last-attempt warning message** or a **Lockout message** to give the user more information.
Only password-based authentication is affected. A password locked user can still sign in through a flow that does not run a Password stage, such as a [passwordless flow](#passwordless-patterns).
### Lock or unlock a password
An administrator can use **Lock password login** and **Unlock password login** on a user's details page. Existing sessions and other authentication methods are not affected. Deactivated users can be locked as well; service accounts cannot, because they do not authenticate with passwords.
Users can also lock their own password. This can be used to enforce passwordless sign-in for an account: once locked, only flows without a Password stage, such as passkey or MFA-based flows, can authenticate the user.
Changing or resetting the password clears the failure count but does not remove the lock. An administrator must unlock password login separately.
## Flow integration
This stage is typically bound after an [Identification](../identification/index.mdx) stage and before an [Authenticator Validation](../authenticator_validate/index.mdx) or [User Login](../user_login/index.mdx) stage.

1
website/docs/enterprise/enterprise-features.mdx
View File

@@ -37,6 +37,7 @@ See the [pricing page](https://goauthentik.io/pricing/) for current plan details
- [Password history compliance](../customize/policies/types/password-uniqueness.mdx) prevents users from reusing previous passwords.
- [Client certificate authentication](../add-secure-apps/flows-stages/stages/mtls/index.mdx) authenticates or enrolls users with client certificates from devices, smart cards, PIV cards, or hardware tokens.
- [RADIUS EAP-TLS](../add-secure-apps/providers/radius/index.mdx#eap) authenticates network clients with EAP-TLS and client certificates.
- [Password lockout](../add-secure-apps/flows-stages/stages/password/index.mdx#password-lockout) locks a user's password after a configurable number of consecutive failed login attempts.
- [Account Lockdown](../security/account-lockdown.mdx) immediately secures a compromised account by disabling it, revoking its tokens, ending its sessions, and recording the action in the audit log.
### Audit and reporting