When working through the Basic with Lockout code
if unlock_and_authenticate:
self.unLockUser(user_name)
self.setUserAttributeValue(user_name, self.invalidLoginCountAttribute, StringHelper.toString(0))
logged_in = authenticationService.authenticate(user_name, user_password)
There is no post-processing logic that checks if that newly unlocked user fails a try and increments the counter, perhaps by adding
if not logged_in:
self.setUserAttributeValue(user_name, self.invalidLoginCountAttribute, StringHelper.toString(1))
The subsequent issue is if lockout threshold is '0' invalid logins then re-locking logic should be triggered. Ideally this should be re-worked into calling the lockout processing function again as a method.