ARTIFACTORY: Setting Up User Lock Policy and Recovering Locked Users in Artifactory

Introduction

Artifactory allows you to set a user locking policy that locks users after they exceed the maximum configured failed login attempts. This policy can be enabled, disabled, or configured via the UI under Administration → Security → General

The policy can also be configured via the REST API using the Configure User Lock Policy call.

What should we do if the users got locked out of Artifactory?

When performing a login, an account may become locked due to repeated incorrect username or password attempts. Once the failed login-attempt threshold is exceeded, the user receives an error message on the login screen stating that the login failed due to an incorrect username/password or a locked user.

Note:

Unlocking locked users requires administrator access to Artifactory.

You can get the information on the locked users using the UI by navigating to Administration → User Management  → Users and the Get Locked Out Users REST API

Textproto

curl --request GET \
     --url https://jpd.local/artifactory/api/security/lockedUsers \
     --header 'accept: application/json' \
     --header 'authorization: Basic xxxxxxxxxx'
[ "test" ]%

To unlock a locked user, a user with Administer Platform permission can perform one of the following:

• Unlock the user via the UI by navigating to Administration → User Management  → Users → click on the lock icon of the relevant locked user:

• Unlock the user via the REST API using the Unlock Locked-Out Users.

Textproto

curl --request POST \
     --url https://jpd.local/artifactory/api/security/unlockUsers \
     --header 'accept: application/json' \
     --header 'authorization: Basic xxxxxxxxx' \
     --header 'content-type: application/json' \
     --data '["test"]'
Specified users were successfully unlocked%

It is also possible to unlock all of the locked users as opposed to a specific user, via the UI by navigating to Administration → Security → General and selecting “Unlock All Users”.

Using the REST API to Unlock All Locked Out Users call.

Textproto

curl --request POST \
     --url https://jpd.local/artifactory/api/security/unlockAllUsers \
     --header 'accept: application/json' \
     --header 'authorization: Basic xxxxxxxxxxx'
All users were successfully unlocked%

What if none of the admin users have access to Artifactory?

In this scenario, we can either recreate an existing administrator user or bootstrap a new admin user to obtain administrator access to Artifactory and unlock other users or change the user locking policy. This can be achieved by following the steps listed in this documentation section of Recreating the default admin user.