
00u115tq2bcqV3sKr351.5645214289422644E12 (Customer) asked a question.
Sign In Widget, warning before locked out?
I am interested to know if there is a way to display a warning that in X number of login attempts, the user account will be locked out. i.e., "You will be locked out after {x} more failed login attempts"
I dived into https://github.com/okta/okta-signin-widget/blob/master/packages/%40okta/i18n/src/properties/login.properties and couldn't find anything that seemed to fit the bill.
TIA!

Hi @00u115tq2bcqV3sKr351.5645214289422644E12 (Customer) , Thank you for reaching out to the Okta Community!
There is currently no feature in Okta that would allow you to display the number of failed attempts to the end-user.
As an Okta Admin, you can go to Okta Admin Dashboard→ Security→ Authentication→ Password and configure a password policy with a specific number of attempts before lock-out and you can also choose the "Show lock out failures" option. But this will not show the end-users how many attempts they have left. It will only inform them that they are locked out. More details about password policies can be found here: https://okta-help.pixtulate.com/en/prod/Content/Topics/Security/policies/configure-password-policies.htm
Hope this helps!
Hi Mihai, thanks for the prompt reply. In that case, is there a message I can modify when the login is rejected that just says a blanket statement akin to "Invalid username or password. After 5 failed login attempts, your account will be locked." ?
There might be. Looking at the following article https://okta-developer.pixtulate.com/docs/guides/custom-widget/main/#modify-strings → seems like you can change the strings for the failed attempt.
My advice would be to reach out to okta-devforum.pixtulate.com and take advantage of their expertise.
Otherwise maybe look into Okta Admin Dashboard→ Customizations→ Other→ "Username & Password Fields" → "Password info tip" and edit that to say something like "You have a total of X attempts" - but it might be confusing to the end-users if does not do a countdown.
All that being said, I don't really recommend this approach from a security stand point, as it lets potential hackers know how many times they can try before raising suspicion.