Starting with this release we have added a protection against brute force login attacks which aim to gain access to user accounts by repeatedly trying to guess the username and password. A user account will be locked out for a set period of time after a number of failed login attempts. In this way, Product 360 is able to prevent automated attacks. All failed attempts of the same user on each server are counted individually, no matter from where the request is coming (e.g., from Desktop UI, Web UI or via a REST call). The count of failed attempts is automatically reset once the lock period is reached, or a login has been successful before the number of

maximumFailedAttempts

has been reached. The corresponding maximum allowed attempts count and lock period are configurable within the following settings in the

plugin_customization.ini

.