Search code examples
keycloak

How to Disable user account after 5 consecutive failed login attempts using Keycloak


I have a use case where user should be disabled when he enter wrong password 5 consecutive times. I cant find any keycloak password policy to disable user when he enter wrong password 5 consecutive times.


Solution

  • To enable Consecutive Failed Login Defence you need to enable "Max Login Failures" from Brute Force Detection. Steps:

    1. Login to Keycloak Admin Console
    2. Select Realms from List
    3. Go To Realm Settings >> Security Defenses >> Brute Force Detection
    4. Enable Brute Force Detection
    5. Set Max Login Failures to 5

    Refer screenshot for stepsenter image description here