Account-locking and how to unlock

There are a number of ways for your account to be locked and inaccessible.

Too many attempts

Firstly, if you/someone tries to log in too many times (p.t. 6 times), with a wrong password, the account will be locked.

This will prevent any further logins with this account, but will NOT terminate any already authenticated sessions.

Unfortunately, there is presently no way for a user to check if their account is locked without being able to log in.

To get your account unlocked, contact Support

This is the only “Right” way for your account to be locked. All other lockings are bugs, and can be diagnosed by checking if this is a partial locking.

partial locking is if your account can be used for some log in purposes, such as VPN, but not for others, such as RStudio.

Partial locking: Expired kerberos tickets

When you log in to a KAC host, including when logging in with RStudio or Jupyter, a new Kerberos ticket is requested for your session.

This ticket is valid for 24 hours.

Your home folder is mounted and “decrypted” with this ticket.

Without a valid ticket, your home folder cannot be read. This have the unfortunate sideeffect of making your home folder inaccessible with your ticket expires. 

Programs that run longer than 24 hours will thus fail.

This can place RStudio in an invalid state where you cannot log in.

This is different than account locking, as your password will still work for VPN access, but you will be unable to log into RStudio

KAC Support can terminate your session and stop the RStudio, making you able to log in again.

KRenew

To alleviate this problem, we have installed a little program (krenew) that automatically renews your ticket for up to 30 days. Note: this does NOT solve the problem, it just postpones it.

Jobs can now run for up to 30 days without problems, but after that they will fail. 

So the problem is mostly frequent if you do not log out of RStudio when abandoning it for weeks on end. Then your login will fail when you return, as the RStudio session kept running until the Kerberos ticket expired and then failed.