Administrator Account Locked – Authentication Failed for Web Service Account in CA Strong Authentication UDS

Products

• CA Strong Authentication

Issue/Introduction

Administrators may observe repeated authentication failures for a web service administrator account in the arcotuds.log file. The error indicates the account is locked due to exceeding the maximum failed login attempts.

Error Messages

In arcotuds.log:

Authentication failed. com.arcot.admin.framework.auth.AuthenticationException: 
Administrator '*** (Organization: ***)' account is locked.

or

Authentication Result for Administrator '*** (Organization: ***)': failed.
Maximum attempts exceeded, Administrator account is locked

Environment

CA Advanced Authentication

 

Cause

 

• An application or scheduled process is making authentication calls to UDS using incorrect/outdated credentials for the service account.
• After multiple failures, the strike count reaches the configured maximum (default/max = 10) and the account is locked.
• Password updates performed via the Administration Console do not automatically unlock the account or clear the strike count in all cases.
• In some environments (especially after migration to new servers pointing to an existing database), residual state in the database or application server cache can prolong the issue.

 

Resolution

Unlock / Reset the Account

• Log in to the CA Strong Authentication Administration Console as MASTERADMIN.
• Navigate to Organizations → <Org name>→ <User>.
• Update the password.
• Immediately clear the strike count in the database:

  • UPDATE ARADMINBASICAUTHUSER 
    SET STRIKECOUNT = 0 
    WHERE USERID = ' <User>' 
      AND ORGNAME = '<Org name>';

    COMMIT;

• Restart UDS, Administration Server, and Strong/Risk Management Server.

3. Identify the Source of Failed Requests

• Enable debug logging on UDS.
• Look for the timing of failures (commonly every hour at specific minutes).
• Search application and server logs for calls using the affected account.
• Confirm no residual references exist in configuration files or the database.

4. Long-term Recommendation

Create a dedicated service account specifically for web service authentication and apply a more appropriate lockout policy (or exclude it from aggressive lockout if security policy allows).

Additional Information

Prevention

• Use dedicated service accounts for programmatic access.
• Implement proper credential management and rotation procedures.
• Validate request payloads in applications before calling UDS APIs.
• Monitor strike counts for service accounts periodically.

If the issue persists after following the steps above, collect following information and open a support case:

• Relevant sections of arcotuds.log (with debug enabled)
• Output of:

  SELECT USERID, ORGNAME, STRIKECOUNT, PASSWDRESETTIME 
  FROM ARADMINBASICAUTHUSER 
  WHERE USERID = '<user>';

• Confirmation of CA Strong Authentication version