Cannot disable users with disable(String reason) method

[YuSheng]

Dear community,

I'd like to block users from login with user.disable("reason") method in my Servlet under certain condition.

I could read/write user properties, but the disable part doesn't work and I could still login with this user.

(code snippet attached below)

Did I miss something important to make it work?

Thanks a lot! 

UserManager userManager = ((JackrabbitSession) session).getUserManager();
Authorizable userAuth = userManager.getAuthorizable(userId);
User user = (User) userManager.getAuthorizable(userId);

if (userAuth != null) {

	int totalCount = 1;
	SimpleDateFormat sdf = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss");
	Value[] userPropertyValueArray = userAuth.getProperty("profile/loginAttemptCount");

	if (userPropertyValueArray != null) {
		int userFailureLoginCount = Integer.parseInt(userPropertyValueArray[0].toString());

		if (userFailureLoginCount == 5) {						
			Date nowTime = new Date();						
			long time = 15 * 60 * 1000;
			Date lockUntil = new Date(nowTime.getTime() + time);
			userAuth.setProperty("profile/lockUntil",
					session.getValueFactory().createValue(sdf.format(lockUntil)));
			user.disable("Reach failure login limit");
			return;
			
		} else {
			totalCount = userFailureLoginCount + 1;
			userAuth.setProperty("profile/loginAttemptCount", session.getValueFactory().createValue(totalCount));
		}
	}
	
	userAuth.setProperty("profile/loginAttemptTimestamp",
			session.getValueFactory().createValue(sdf.format(new Date())));
}

session.save();
session.logout();

[arunpatidar]

Could you please check below thread if this helps

https://experienceleaguecommunities.adobe.com/t5/adobe-experience-manager/how-to-disable-user-login/... 

[YuSheng]

Hi @arunpatidar, thank you for the reply.

I've seen this post and it doesn't help in my case.

Simply wanna know how to make this method work since it's the most straitforward approach to prevent user from login.

[lukasz-m · Accepted solution]

Hi @YuSheng,

I did a quick check of disabled method usage and it worked fine on my end. In general it sets rep:disabled property with string value I have passed as an argument. This is a sample code.

UserManager userManager = ((JackrabbitSession) session).getUserManager();
User user = (User) userManager.getAuthorizable("test");
user.disable("Reach failure login limit");
session.save();

I see one problem in your implementation, in below part of your code

		if (userFailureLoginCount == 5) {						
			Date nowTime = new Date();						
			long time = 15 * 60 * 1000;
			Date lockUntil = new Date(nowTime.getTime() + time);
			userAuth.setProperty("profile/lockUntil",
					session.getValueFactory().createValue(sdf.format(lockUntil)));
			user.disable("Reach failure login limit");
			return;
			
		} 

You are using return statement before you saved your changes, this is why user account is not disabled.

Please remove return statement from the body of above if condition block, or add session.save before return. In other words currently you are not saving changes you did.

Your code could look like below

if (userFailureLoginCount == 5) {						
  Date nowTime = new Date();						
  long time = 15 * 60 * 1000;
  Date lockUntil = new Date(nowTime.getTime() + time);
  userAuth.setProperty("profile/lockUntil",			session.getValueFactory().createValue(sdf.format(lockUntil)));
  user.disable("Reach failure login limit");
  session.save();
  return;
} 

or like that

if (userFailureLoginCount == 5) {						
  Date nowTime = new Date();						
  long time = 15 * 60 * 1000;
  Date lockUntil = new Date(nowTime.getTime() + time);
  userAuth.setProperty("profile/lockUntil",			session.getValueFactory().createValue(sdf.format(lockUntil)));
  user.disable("Reach failure login limit");
} 

[YuSheng]

@lukasz-m Thanks for the reply, I check the exception when the the disable was executed and got 

"javax.jcr.AccessDeniedException: OakAccess0000: Access denied"

I think the problem is the system user I created doesn't have enough permission to execute disable.