Hello,
You can do something similar with Adaxes. On the 4th attempt, the option will not be greyed out / disabled, however it is possible to cancel operation. In this case, users will be returned back to the page where they can chose to reset or not reset their passwords, and you can also specify a cancel reason so that users know what to do and why they cannot unlock their accounts.
To implement such a solution, you'll need two Business Rules, one of them will be triggered before self-resetting password, and another one triggered after. Note that rules triggered by self-resetting password are executed not only when users reset passwords for themselves, but also when they unlock their accounts without resetting a password.
Also, you'll need to use a certain property that can store integer values (numbers). It'll serve as a counter to identify how many times a user has unlocked his/her account. We suggest using one of Adaxes virtual properties (for example, CustomAttributeInt1). Such properties are not stored in AD, but can be used as any other properties of AD objects.
The Business Rule triggered before self-resetting password will cancel the operation if a user has unlocked his/her account 3 times already. To create such a Business Rule:
- Create a new Business Rule.
- On the 2nd step of the Create Business Rule wizard, select User and Before Self-resetting password.
- On the 3rd step, add the Cancel this operation action.
- Optionally, you can add a short note to users why they can't simply unlock their accounts in the Reason for canceling field.
- Click OK.
- Now, you need to add conditions when an attempt should be canceled. First of all, you need to add a condition for the Business Rule to be triggered only when users try to unlock their accounts, but not when they unlock and reset their password. Right-click the action that you've added and click Add Condition.
- Select the If <property> <relation> <value> condition type.
- Expand the <property> drop-down list and select Show all properties.
- Select the Password property.
- Select is empty. The password property will be empty only if users don't reset their passwords.
- Click OK.
- Now, you need to add a condition for the Business Rule to be triggered only when a user has unlocked own account 3 times already. Right-click the action again and click Add Condition.
- Select the If <property> <relation> <value> condition type.
- Expand the <property> drop-down list and select Show all properties.
- Select the property that you want to use as the unlock attempt counter, for example, CustomAttributeInt1.
- Select greater or equal and type 3.
- Click OK. You should receive something like this:
- Finish creation of the Business Rule.
The Business Rule triggered after self-resetting password will increase the unlock attempt counter each time a user manages to successfully unlock his/her account. Also, it'll reset the counter once a user self-resets his/her own password. To create such a Business Rule:
-
Create a new Business Rule.
-
On the 2nd step of the Create Business Rule wizard, select User and After Self-resetting password.
-
On the 3rd step, add the Run a program or PowerShell script action. You'll need a script to increase the unlock attempt counter.
-
Paste the following script in the Script field:
$attemptCounterProperty = "adm-CustomAttributeInt1" # TODO: modify me
# Get number of times the user has been unlocked
try
{
$unlockCounter = $Context.TargetObject.Get($attemptCounterProperty)
}
catch
{
$unlockCounter = 0
}
# Increase by 1 and save
$unlockCounter++
$Context.TargetObject.Put($attemptCounterProperty, $unlockCounter)
$Context.TargetObject.SetInfo()
-
In the script, $attemptCounterProperty specifies the property to be used as the unlock attempt counter. If you want to use another property, change it.
-
Enter a short description for the script and click OK.
-
Now, you need to add a condition for the counter to be increased only when password is not reset. Right-click the action that you've added and click Add Condition.
-
Select the If <property> <relation> <value> condition type.
-
Expand the <property> drop-down list and select Show all properties.
-
Select the Password property.
-
Select is empty.
-
Click OK.
-
Now, you need to add one more action/condition set that will reset the unlock attempt counter upon password reset. Click the Add action to a new set link.
-
Add the Update the user action.
-
Click Add.
-
Expand the Property to modify drop-down list and select Show all properties.
-
Select the property to be used as the unlock attempt counter.
-
Switch the radio button to Remove property and click OK 2 times.
-
Now, you need to add a condition for the counter to be reset only when password is reset. Right-click the action that you've added and click Add Condition.
-
Select the If <property> <relation> <value> condition type.
-
Expand the <property> drop-down list and select Show all properties.
-
Select the Password property.
-
Select is not empty.
-
Click OK. You should receive something like this:
-
Finish creation of the Business Rule.