DominoArea.org [Archive]

La base d'aide Lotus Domino mentionne :

For single sign-on, the Domino server on which the Internet password
lockout feature is enabled must also be the server that issues the
single sign-on key. If this key is retrieved from another source
(another Domino server or WebSphere server), the SSO token will always
be valid on the Domino server, regardless if Internet password locking
is enabled.

The document in inetlockout.nsf contains :
Server name - the server for which the user is either locked out or has
failed authentication attempts
User name - name of user who is locked out or who has logged failed
authentication attempts
Locked out - in the Login Failures view, this value can be either yes or
no. In the Locked Out Users view, this will be set to Yes.
Failed attempts - shows the current number of failed authentication
attempts for each user. In the Locked Out Users view, this should equal
the threshold setting.
First failure time - shows the date and time of the first authentication
failure
Last failure time - shows the date and time of the last authentication
failure. This can also be the time the user got locked out. If the user
is locked out and tries again, this time is not updated.

The Internet Lockout database is created with a replica ID that stays
the same for any replica on any server for which Internet password
locking is enabled in a domain. By default, replication is temporarily
disabled for Internet lockout databases. This is to prevent replication
storms described earlier. To replicate the database to another server,
disable the Temporarily disable replication option in the Other section
of the Replication Settings dialog box. You can then set up the database
to replicate (either scheduled or clustered replication).

Le fait d'activer la réplication de la base ne permet QUE de savoir sur quel(s) serveur(s) l'Utilisateur est bloqué

Note When you replicate this database to other servers, the 'invalid
attempts' information is calculated for each individual server. For
example, if the threshold for 'John Doe' is three, and he has two
invalid attempts on Server A and has one on Server B, he is not locked
out of either server. The attempts are not combined for a total of
three. The reason for replication is ease of administration, not to
establish global thresholds.

De ce fat, un Utilisateur bloqué sur le serveur A ne l'est pas forcément sur le serveur B, même si A et B sont en cluster