On Tuesday 30 June 2009 00:35:47 Howard Chu wrote:
In my opinion, this feature should be removed from the spec and replaced
with an incremental delay instead.
Removing it will (AFAIK) mean that implementations supporting the spec (alone)
will not be compliant with many IT security policies supporting SAOX. Whether
the policies were written with good understanding, or just by feature sets
available in other software, is irrelevant IMHO.
I.e., when any login attempt fails,
start adding delays before processing subsequent attempts from the same
client (or for the same user).
In a widely distributed environment, it makes little sense to replicate a
password failure incident to servers located halfway around the world.
However, at present, this does occur. Password failures and lockout on a
syncrepl provider are replicated to any of its consumers. However, the
password failure incident is not replicated to the providers provider, so if
the account has not been locked out on the ultimate master, it is inconvenient
to unlock the account. Additionally, password failures that were recorded on
consumers are not guaranteed to be cleared ...