Leap lockouts due to incorrect password entry should have a unique error message
We had a front-line staff member contact us because he was getting a "The domain, username or password is incorrect" error message when he tried to log in to Leap. Support was able to tell us that he was locked out because he had incorrectly typed his password five times. They confirmed that the error message that will be shown when this happens is "The domain, username or password is incorrect." Not only is that error message text factually untrue, it is identical to the error message that a staff person sees if their password actually IS being entered incorrectly. It encourages them to keep trying to log in instead of waiting for the end of the 30-minute lockout period, and might even lead to additional lockouts.
Since Support confirmed they can distinguish these two cases, a separate error message should be created for lockouts. "An incorrect password has been entered for this account five times. The account is now locked for 30 minutes." Something like that.
![](https://secure.gravatar.com/avatar/91d04674245d323469617e7b3a16b076?size=40&default=https%3A%2F%2Fassets.uvcdn.com%2Fpkg%2Fadmin%2Ficons%2Fuser_70-6bcf9e08938533adb9bac95c3e487cb2a6d4a32f890ca6fdc82e3072e0ea0368.png)
-
Emma Olmstead-Rumsey commented
Hi Sam, we are using standard authentication, not OAUTH. Thanks for looking at this.
-
AdminSamantha Quell (Admin, Innovative) commented
Emma - Can you clarify if you're using Leap with the standard authentication method or the OAUTH authenitcation method? This may impact the error data available to Leap.