I am developing a form which will allow a user to unlock himself (or herself). For the user to get unlocked he or she has to provide the username, password and the answer to the sercret question. So, the first thing I do is to get the user (GetUser()) based on the typed username and then I try to get the password (GetPassword()) to validate it against what was entered in the form but I get an exception telling me that the user is locked out. I thought about temporarily unlocking the user but I do not know how to lock the account in case the information provided is incorrect. My main issue is to get the password so it can be validated and then continue validating the secret answer. One option would be not to validate the password, only the secret answer, but this is not as secure as including the password. Please advice.
Respectfully,
Jorge Maldonado
...
Go to the complete details ...