KB321528: LDAP User locked after a first failed attempt in MicroStrategy Web 10.3, even when the LDAP lockout is set to three attempts.

Summary:
In any LDAP configuration, administrators can set the number of incorrect password attempts before an account is locked. This will prevent hackers from trying to access the system through brute force attacks and will make locked end users to seek help from their LDAP administrator.
 
Symptom:
In Strategy Web 10.3, using LDAP authentication, a single failed attempt may result in the lockout. Even if the LDAP lockout is set three failed password attempts.
 
Steps to Reproduce:

1. Enable the authentication trace log, which can be found in the Diagnostics Configuration as per KB42880: https://community.microstrategy.com/t5/Server/KB42880-How-to-turn-on-new-traces-using-the-Diagnostics/ta-p/192718
2. Try to login to a project with incorrect credentials from Strategy Web using LDAP authentication.
3. Review the Authentication Trace Log and notice that multiple login attempts are made as seen below:

 

2017-01-09 09:28:09.631-05:00 [HOST:ServerName][PID:13560][THR:448911104][Authentication Server][Trace] Login using LDAP with LDAP User='Username'

2017-01-09 09:28:10.985-05:00 [HOST:ServerName][PID:13560][THR:448911104][Authentication Server][Trace] LDAP authentication trace: user 'xxx'' with client type ='DSSWeb' failed in bind to LDAP server 'LDAP Server Name' on port '389'. (LDAP error 49: Invalid credentials)

2017-01-09 09:28:11.006-05:00 [HOST:ServerName][PID:13560][THR:446809856][Authentication Server][Trace] Login using LDAP with LDAP User='Username'

2017-01-09 09:28:13.189-05:00 [HOST:ServerName][PID:13560][THR:446809856][Authentication Server][Trace] LDAP authentication trace: user 'xxx'' with client type ='DSSWeb' failed in bind to LDAP server 'LDAP Server Name' on port '389'. (LDAP error 49: Invalid credentials)

2017-01-09 09:28:13.224-05:00 [HOST:ServerName][PID:13560][THR:415291136][Authentication Server][Trace] Login using LDAP with LDAP User='Username'

2017-01-09 09:28:13.263-05:00 [HOST:ServerName][PID:13560][THR:415291136][Authentication Server][Trace] LDAP authentication trace: user 'xxx' with client type ='DSSWeb' failed in bind to LDAP server 'LDAP Server Name' on port '389'. (LDAP error 49: Invalid credentials) 

 
 
Workaround:
 

1. Inside the Web Administration Page, Navigate to the “Default properties” under the Intelligence Server section on the left pane.
2. Select the option to “Show all the projects connected to the Web Server before the user logs in”

 
Action:
This known issue is now fixed in 10.7 and 10.4 HF3. Case logged under internal number DE52740.