Unable to unlock locked-out member in +03:00 (more than 00:00) time zone

[chetvergok]

Which Umbraco version are you using? (Please write the exact version, example: 10.1.0)

13.5.0-rc

Bug summary

The 'IsLockedOut' property seems to be has wrong logic.

My time zone is '+03:00'. The "MemberDefaultLockoutTimeInMinutes" is 1.

Member become unlocked after 3h1m.

This is my debug data:

I don't understand why mbr.LockoutEnd.Value.ToLocalTime() >= DateTime.Now get 'true'

Specifics

No response

Steps to reproduce

Work on time zone +01:00 plus
Set 'MemberDefaultLockoutTimeInMinutes' parameter to '1'
Lock out a test user by trying wrong password
Wait 2 minutes
Member is still locked (UmbracoIdentityUser.IsLockedOut)

Expected result / actual result

No response

[github-actions]

Hi there @chetvergok!

Firstly, a big thank you for raising this issue. Every piece of feedback we receive helps us to make Umbraco better.

We really appreciate your patience while we wait for our team to have a look at this but we wanted to let you know that we see this and share with you the plan for what comes next.

• We'll assess whether this issue relates to something that has already been fixed in a later version of the release that it has been raised for.
• If it's a bug, is it related to a release that we are actively supporting or is it related to a release that's in the end-of-life or security-only phase?
• We'll replicate the issue to ensure that the problem is as described.
• We'll decide whether the behavior is an issue or if the behavior is intended.

We wish we could work with everyone directly and assess your issue immediately but we're in the fortunate position of having lots of contributions to work with and only a few humans who are able to do it. We are making progress though and in the meantime, we will keep you in the loop and let you know when we have any questions.

Thanks, from your friendly Umbraco GitHub bot 🤖 🙂

[Migaroez]

Hey @chetvergok, thank you for the detailed bug report #h5yr!

I have been able to reproduce this with different timezones and a PR will be submitted shortly

[gregor-tusar-sowa]

I have a similar problem with unlocking a member. If the lastLockoutDate is more than 30 days in the past, then we cannot unlock the user via Backoffice. If I change this date, then I can unlock the user normally.

I guess this is a bug.

Using Umbraco v13.5.2

[markadrake]

I'm using Umbraco 13.5.3, and we cannot unlock members. The conditions described by the above commenters appear to be the same.

[Myster]

I observe the original issue in Umbraco 13.7.2 in that if I set MemberDefaultLockoutTimeInMinutes to 5, then a locked out account is not unlocked 5 min after the 'last lockout date'

I do not see the issue where I cannot un-tick the locked out checkbox, I am able to unlock the account by clicking this and saving, but I want the site to auto unlock after 5 minutes.

[konius]

Experiencing the same issue on 13.8.1 where I can't unlock a member.

UI allows to uncheck the Locked out property, but on save it returns to True state.

[umbracocommunity]

This issue has been mentioned on Umbraco community forum. There might be relevant details there:

https://forum.umbraco.com/t/unable-to-unlock-a-member/3810/3

[gregor-tusar-sowa]

We are observing now the same problem as OP.

We are on v13.8.1 and suddenly when the members get locked out due to too many wrong password attempts, they are not unlocked anymore when they reset the password.

The password of the member changes, but IsLocked does not go to false. So even if the member successfully changed the pasword and try to login with new password, they get an error that they are locked.

I tried to set lastLockoutDate to the past and then IsLocked is set to false when you reset the password.

The code used to reset the password:

var result = await memberManager.ResetPasswordAsync(identityMember, model.Token, model.Password);

Changed "MemberDefaultLockoutTimeInMinutes": 1, but the user doesn’t get unlocked if I reset the password after 1 minute after locking the account.

I also did some debugging and found out that in Microsoft.AspNetCore.Identity.UserManager there is a method IsLockedOutAsync that compares lockoutTime with UtcNow:

var lockoutTime = await store.GetLockoutEndDateAsync(user, CancellationToken).ConfigureAwait(false);
return lockoutTime >= DateTimeOffset.UtcNow;

The problem is that it seems to compare local time and Utc time and does not take timezone into account.

EDIT:
Just an observation. We were not using default Umbraco's controller to change the password, but we had our own.

I saw that in the default implementation there is a logic that changes the last lockout date to now the user and resets the failed password count to zero manually. Code line 678.

So without using this additional code to reset and unlock, the user got unlocked only after the difference in CET - UTC elapesed.