User Lockout Prompt & Per-User Failed Logon Alarm

[tfranklin]

I'm not really sure when this changed, but users who lock themselves out of the DB no longer get a notification that their account has been locked out.  Ex: You allow 5 logon attempts at the server level.  A user logs in 5 times with invalid credentials.  On the 6th attempt they're now disabled, but they'll continue to receive a message that simply says "Invalid username/password." We've had users continue to log in multiple times after this. 

This leads me to another improvement idea related to security. 

Take the Logon Attempt Fail counts and turn them into an alarmable item per-user.  Allow a setting on each user that says Alarm After x Failed Logons.  Right now we can do some roll-ups to do this by querying the event journal, but it's less than ideal as the event journal is pretty heavy.  In my head this should be configurable whether the user is locked out or not. 

Related to the failed logon attempt property, I noticed that this number does not increase once the user is locked out.  If my lockout occurs after 5, the user logon failed count will increase to 5 then stop once locked out.  I can log in 50000 more times and it would still read 5 since my user is locked out.  I think it should continue to increase as it's an attempt against the user.  The lockout state is agnostic to this metric. 

[sbeadle]

Thanks Trent,

the login warning for any kind of failed login will always be "Invalid username/password." It's best practice to do this so information about valid user names is not leaked.

We will look at the failed login count comments.

Steve