From a96b35e364d58462dfc81bbf9a845b5b5933cf10 Mon Sep 17 00:00:00 2001
From: Qiu Jian <qiujian@yunionyun.com>
Date: Mon, 18 Nov 2019 08:48:51 +0800
Subject: [PATCH] fix: always lock login-failed user when
 PasswordErrorLockCount not initialized

---
 pkg/keystone/driver/sql/sql.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkg/keystone/driver/sql/sql.go b/pkg/keystone/driver/sql/sql.go
index 0cde7e5b54..7f29d1cb59 100644
--- a/pkg/keystone/driver/sql/sql.go
+++ b/pkg/keystone/driver/sql/sql.go
@@ -57,7 +57,7 @@ func (sql *SSQLDriver) Authenticate(ctx context.Context, ident mcclient.SAuthent
 	err = models.VerifyPassword(usrExt, ident.Password.User.Password)
 	if err != nil {
 		localUser.SaveFailedAuth()
-		if localUser.FailedAuthCount > o.Options.PasswordErrorLockCount {
+		if o.Options.PasswordErrorLockCount > 0 && localUser.FailedAuthCount > o.Options.PasswordErrorLockCount {
 			models.UserManager.LockUser(usrExt.Id)
 		}
 		return nil, errors.Wrap(err, "usrExt.VerifyPassword")