Introduction
If your environment is up and running, CI builds are running as expected, but you suddenly start getting 403 error responses with your builds, it may be due to the Temporary Login Suspension functionality.
Once a user login attempt fails to authenticate with 401 error, and these failures are consecutive within a short timeframe, then, due to the "Temporary Login Suspension" functionality, that user gets temporarily blocked for a short period (depending on the number of failures, up to 60 seconds).
During this timeframe, every request of this user, even with the correct password, will be blocked by Artifactory, with a 403 error.
If you have rotated your API Keys or Access Tokens lately, it might be the explanation for the 403 issue. Most likely there’s some agent or client that still uses the old API-key/token/password, which 'locks' the user temporarily, and during this timeframe, requests are failing with 403 errors.
Identifying the client that locks the user:
We would like to start with finding the log entries which might explain the behavior mentioned above. To do that, we recommend looking for the below entries in the logs:
artifactory-request.log:
2025-07-07T06:27:59.235Z|6119edf583eb8984|172.17.0.1|non_authenticated_user|GET|/generic-local1/nuget-list-delta.txt|403|-1|0|25|curl/8.7.1
Note
You may find the corresponding request in other logs using the same Trace ID 6119edf583eb8984:
artifactory-access.log:
2025-07-07T06:27:59.235Z [6119edf583eb8984] [DENIED LOGIN] for client : testuser / 69.174.144.109
Artifactory-service.log:
2025-07-07T06:27:59.233Z [jfrt ] [WARN ] [6119edf583eb8984] [a.u.AccessAuthProviderUtils:53] [http-nio-8081-exec-4] - Access authentication failed for user: 'testuser'. Status code: 400
2025-07-07T06:27:59.234Z [jfrt ] [WARN ] [6119edf583eb8984] [.u.AccessAuthProviderUtils:540] [http-nio-8081-exec-4] - This request is blocked due to recurrent request failures, please try again in 2 second(s)
Attempting to perform UI login during the Login Suspension (with valid credentials):
Access-service.log:
2025-07-07T06:28:11.241Z [jfac ] [WARN ] [6119edf583eb8984] [.e.ResponseExceptionHandler:47] [27.0.0.1-8040-exec-4] - User testuser is blocked due to incorrect login for 47 second(s)
The out-of-the-box logs are showing a denied login for "testuser" originating from IP 69.174.144.109 with the client curl/8.7.1. This suggests that outdated credentials from this IP and user-agent are likely causing the associated user to experience temporary login suspensions.
It's important to note that in Self-Hosted Artifactory versions 7.90.5 and above, the Temporary Login Suspension configuration has been moved to the Access Service.
- If you're using an older Self-Hosted Artifactory version (below 7.90.5) and are still unsure if the 401 errors are directly related to the user getting suspended, please note that on these lower versions, some of the log entries above are only seen in DEBUG level. We can activate enhanced debug logging. To do this, please add the XML snippet provided below to your $@JFROG_HOME/artifactory/var/etc/artifactory/logback.xml file.
<appender name="SecurityUserLock" class="ch.qos.logback.core.rolling.RollingFileAppender">
<File>${log.dir}/artifactory-SecurityUserLock.log</File>
<rollingPolicy class="org.jfrog.common.logging.logback.rolling.FixedWindowWithDateRollingPolicy">
<FileNamePattern>${log.dir.archived}/artifactory-SecurityUserLock.%i.log.gz</FileNamePattern>
</rollingPolicy>
<triggeringPolicy class="org.jfrog.common.logging.logback.triggering.SizeAndIntervalTriggeringPolicy">
<MaxFileSize>25MB</MaxFileSize>
</triggeringPolicy>
<encoder class="ch.qos.logback.core.encoder.LayoutWrappingEncoder">
<layout class="org.jfrog.common.logging.logback.layout.BackTracePatternLayout">
<pattern>%date{yyyy-MM-dd'T'HH:mm:ss.SSS, UTC}Z [jfrt ] [%-5p] [%-16X{uber-trace-id}] [%-30.30(%c{3}:%L)] [%-20.20thread] - %m%n</pattern>
</layout>
</encoder>
</appender>
<logger name="org.artifactory.security.SecurityServiceImpl" additivity="false">
<level value="debug"/>
<appender-ref ref="SecurityUserLock"/>
</logger>Warning
Enhancing the logs as suggested above may have performance implications, should be applied for a limited amount of time. In addition, the enhanced logs may reveal sensitive information, and should be handled with care.
You can now look for the below entries in the newly created artifactory-SecurityUserLock.log, an example would be:
2025-07-07T08:07:14.374Z [jfrt ] [DEBUG] [5ff53487c11c1aa1] [o.a.s.SecurityServiceImpl:1523] [http-nio-8081-exec-9] - Checking if user is not locked
2025-07-07T08:07:14.382Z [jfrt ] [DEBUG] [5ff53487c11c1aa1] [o.a.s.SecurityServiceImpl:1558] [http-nio-8081-exec-9] - Ensuring that user should not be blocked
2025-07-07T08:07:14.382Z [jfrt ] [DEBUG] [5ff53487c11c1aa1] [serLockInMemoryServiceImpl:146] [http-nio-8081-exec-9] - Delayed user: username 'testuser784' login by 500 milliseconds due to 4 incorrect login attempts
2025-07-07T08:07:14.383Z [jfrt ] [DEBUG] [5ff53487c11c1aa1] [o.a.s.SecurityServiceImpl:2238] [http-nio-8081-exec-9] - Updating access details for user, time=1751875634374, ip=52.215.237.185
2025-07-07T08:07:14.408Z [jfrt ] [DEBUG] [5ff53487c11c1aa1] [o.a.s.SecurityServiceImpl:1395] [http-nio-8081-exec-9] - Registering login attempt failure
Suggested actions to remediate the issue
Starting from version 7.90.x, you can modify or disable the temporary login suspension feature using the UI by referring to the Administration Tab | Security | General:
Note:
In a High-Availability cluster, each node independently applies a temporary login suspension. If set to 100, each of 3 nodes will allow 99 incorrect attempts.
- In Artifactory versions below 7.90.5, you can apply the below system properties ( located at $JFROG_HOME/artifactory/var/etc/artifactory/artifactory.system.properties) to remediate the issue until the root cause is found
Note that modifying these may put your Artifactory instance at risk, these should be applied temporarily to un-block the situation while the root cause is investigated. Artifactory restart is required for the changes to take effect:
artifactory.security.maxLoginBlockDelay=60000
The maximum time (in ms) that the user will get blocked, the default is 60 seconds. Seting to '0' means no suspension.
artifactory.security.max.incorrect.login.attempts=2
The consecutive incorrect login attempts that will trigger a temporary suspension for the user. The default is 2. We may increase this as much as needed.
To summarize, by focusing on the DENIED LOGIN log entry’s TRACE_ID, we can identify the locked username, its IP address and the client triggering the login suspension. On Artifactory versions lower than 7.90.5, we recommend adding the XML snippet shared on the logback.xml file to capture this data in DEBUG mode.