Search code examples
oracle-databasec3p0

Failed login attempts in Oracle within what time frame?


I'm trying to configure a C3P0 JDBC connection pool to avoid locking an Oracle DB. Seems like acquireRetryAttempts and acquireRetryDelay are important.

Looking at Oracle 12c docs, I see:

FAILED_LOGIN_ATTEMPTS  
Specify the number of consecutive failed attempts to log in to the user account before the account is locked. If you omit this clause, then the default is 10 times.

Within what time frame do the 10 attempts apply? I.e. if I set acquireRetryAttempts to 9, what value of acquireRetryDelay will avoid locking the DB?


Solution

  • You are asking for a time frame after which Oracle will forget about previous invalid login attempts? There is none.

    Oracle maintains a column lcount in the SYS.USER$ table that has the number of consecutive invalid login attempts. It is only reset to zero upon a successful login.

    If you don't want to lock the database accounts for too many failed password attempts, why don't you set failed_login_attempts to UNLIMITED for the profile your connection pool uses?