LDAP account locked after one wrong authentication attempt

LDAP accounts might be blocked even after only one login attempt when connecting using the web user interface or Dynamic Workload Console through LDAP/AD authentication, if wrong credentials are provided because of internal LDAP/AD security policy. This happens because one login attempt with wrong credentials using the web user interface or Dynamic Workload Console, is transformed into several authentication requests to LDAP.

Cause and solution:

When a single LDAP hostname is mapped to multiple IP addresses in a network configuration, if an invalid password is entered during the login, WebSphere makes as many login attempts as the number of associated IP addresses plus 1. If the resulting number exceeds the maximum number of failed logins allowed by local LDAP/AD security policy, the LDAP account is blocked. In the log file messages.log the following error shows an authentication error because of wrong credentials: 
ECJ0369E: Authentication failed when using LTPA. The exception is
javax.naming.AuthenticationException: [LDAP: error code 49 -
80090308: LdapErr: DSID-0C090334, comment:
AcceptSecurityContext error, data 52e, vece
The WebSphere APAR PK42672 addresses this problem in the following way:
Two new custom properties are available to prevent this issue; use the one suitable for your LDAP configuration:
  1. If LDAP is configured using the wsadminl command to register backend LDAP server hostnames, in the administration console click Security > User Registries > LDAP > Custom Properties and set to true the property com.ibm.websphere.security.ldap.retryBind. If this property is set to false, the Application Server does not retry LDAP bind calls. The default value is true.
  2. If LDAP is configured associating a hostname with multiple IP addresses using the network configuration, in the administration console click Security > User Registries > LDAP > Custom Properties and set to false the property com.ibm.websphere.security.registry.ldap.singleLDAP. If this property is set to true, the Application Server does not resolve an LDAP hostname to multiple IP addresses. The default value is false.