Account Lockout & Password Rotation

Two per-tenant policies that harden local (non-SSO) password logins. Both are off by default — you opt in from Admin → Settings → Security. SSO accounts are never affected; the break-glass recovery account (§5.1.1) is exempt from both so emergency access always works.

Account lockout (LMS-471)

After too many consecutive failed password attempts, an account is locked for a cooldown window. Admins can also unlock manually.

1. Open Admin → Settings → Security → Account Lockout & Password Policy.
2. Set Failed attempts before lock and Lock duration (minutes).
3. Click Save.

• A locked user sees: “This account is temporarily locked after too many failed attempts.”
• The counter resets to 0 on any successful login.
• Lock and unlock events are written to the audit log (locked / unlocked).

Unlocking an account manually

The Locked Accounts panel on the same page lists every currently-locked account. Click Unlock to clear the lock and counter immediately.

Password rotation (LMS-470)

Force local users to change their password every N days.

1. On the same page, set Password rotation (days).
2. Click Save.

• When a user with an expired password logs in (with the correct password), login is refused with: “Your password has expired and must be reset.” They reset it via Forgot password, which records a new change date.
• Accounts that never recorded a change date are treated as expired once rotation is on, so legacy users are forced through one reset.

Network-level login throttling (LMS-557)

Independently of the two policies above, the platform throttles password sign-in attempts to 30 per minute per IP address. This blunts automated password spraying across many accounts from one source. It is:

• Always on — not configurable per tenant.
• Per network, not per user — a large office behind one shared IP that exceeds the limit sees “Too many sign-in attempts from your network. Please wait a minute and try again.” and can retry within a minute.
• Complementary to account lockout — lockout protects a single account; the IP throttle stops one source from attacking many accounts.

SSO sign-ins are not affected (they authenticate at your IdP).

Troubleshooting