BUG found - Bad domain Password attempts in the Self Service portal are doubled in Active Directory

Hello,

We are evaluating the AD Self Service Portal as a password reset solution. We pay extra attention to security, thus we have our domain users locked out after 5 bad password attemtps in the domain (domain policy).

We want to block users in the AD Self service portal after 3 attempts to avoid locking the user in the domain as well.

So far so good.

The issue comes when the user get locked indeed in the self service portal but also gets locked out in active directory.

i noticed that the application logs 2 bad attempts in the domain controller for every 1 bad attempt in the self service portal.

So, i did 3 bad attempts in Self Service portal which translated to 6 bad attempts (doubled) to the domain controller. 6 bad attempts in the DC exceed the 5 attempts threshold thus the account gets locked out.

This is a major bug in my opinion which needs to be solved.