-- Informational:Failed login attempts updates the account status column as LOCKED in 11.2.0.1 --

By David Westfall

There is a known bug under 11.2.0.1 that displays the incorrect account status when a user has accidently locked an account via too many invalid passwords attempts. In a nutshell, too many password attempts should result in a “LOCKED(TIMED)” status, but instead result in a “LOCKED” status. The “LOCKED” status is what an account is set to when a DBA intentionally locks it (i.e. when somebody leaves the company or team). We look for a status of “LOCKED(TIMED)” to verify the validity of password reset requests. However, under 11.2.0.1 we have no way of doing confirming why an account is locked, therefore we have no way to confirm whether requests are valid.

There is a work around which would require updating all profiles to ensure password_lock_time is set to a number, rather than unlimited. Alternatively we can apply the 11.2.0.2 patchset. Going forward, we should make the 11.2.0.2 patchset a requirement for all new 11g databases.