WSO2 IS 6.1.0创建用户自动锁定后Carbon控制台无法解锁的配置咨询

Step 1: Retain Identity Management Policy Settings #

Keep your existing configurations in <IS_HOME>/repository/conf/identity/identity-mgt.properties—these define the auto-lock behavior:

# If account verification is not enabled, following property will decide where user must be lock or not after user is created 
Authentication.Policy.Account.Lock.On.Creation=true
Authentication.Policy.Account.Lock.Time=0
Authentication.Policy.Account.Lock.On.Failure=true
Authentication.Policy.Account.Lock.On.Failure.Max.Attempts=3

Step 2: Adjust Event Listener Configurations #

Update <IS_HOME>/repository/conf/deployment.toml to resolve conflicts between listeners:

[event.default_listener.identity_mgt]
priority= "50"
enable = true

[event.default_listener.governance_identity_mgt]
priority= "95"
enable = false

Step 3: Validate the Fix #

1. Restart WSO2 Identity Server.
2. Create a new user—they will be automatically locked as expected.
3. Go to the user's profile in the Carbon Console, uncheck the "Account Locked" checkbox, and save.
4. Refresh the profile page: the checkbox should stay unchecked, confirming the user is successfully unlocked.

Explanation #

• The identity_mgt listener is responsible for enforcing identity management policies like auto-lock on user creation. Disabling it (as in your initial non-working scenario) prevents this policy from triggering.
• The governance_identity_mgt listener, when enabled alongside identity_mgt, can interfere with lock status updates. Disabling it ensures lock/unlock operations are handled solely by the identity_mgt listener, which correctly persists changes to the user store.

If you require the governance_identity_mgt listener for other use cases, try adjusting priorities so identity_mgt runs after it (e.g., set identity_mgt priority to 90 and governance_identity_mgt to 95) to avoid conflicts.

内容的提问来源于stack exchange，提问作者Lilan Mihiranga