VIP Authhub - User is not getting locked during change password api calls after multi failed password attempts

Products

• VIP Authentication Hub

Issue/Introduction

#### Issue Description 

-  when calling the User Change password API --> /default/factor/v1/MePasswordUpdater

 a user can enter the old password x number of times without getting locked .

- Expectations is that even on the Password change API call , the user should still get locked if old password is entered wrong 5 excessive times (5 is the configured wrong attempts before user gets locked) 

 

Environment

Release : M9

Resolution

This change will be officially releases in M9 OCT 06 release and included in M10 release.

With new implementation USER will get locked if the password updater is invoked with wrong current password after reaching max strike count.

 After this, user token cannot  be used for any other operation and tenant admin have to update user status to active for user to proceed ahead.