Consulting IBM, we discovered the problem; it was the way the driver was being registered.
Driver aDriver = (Driver)Class.forName(driver).newInstance();
DriverManager.registerDriver(aDriver);
To me, it seems benign enough; it creates a new driver and then registers the driver object using the DriverManager object. However, IBM explained that using the DriverManager class actually registered the driver a second time resulting in two drivers in the driver manager's list.
As a consequence, when the user/developer was entering an invalid password for an unfortunate second time, it processed the event again with the second driver in the list and so counted that as the third invalid attempt. The user's profile had been established so that it became invalid on the third invalid login attempt.
The remedy was simple enough; comment out the 2nd line.
No comments:
Post a Comment