Unlock user account using OpenAM Forgot Password flow

OpenAM provides "Account Lockout" functionality which can be used to configure various lockout parameters such as failure count, lockout interval etc. 
Note that OpenDJ also provides Account Lockout functionality, this article is based on OpenAM Account Lockout policies. Refer this KB article for more differences between OpenAM and OpenDJ lockout polices. 

Using OpenAM "Account Lockout" policies, users may get locked out with invalid login attempts. OpenAM offers both Memory and Physical lockouts. Using memory lockout, users get unlocked automatically after specified duration. 

Many deployments use "Physical lockout" due to security requirements. When this lockout mode is used then there should be some Self-service flow so that user can unlock themselves. Why not use OpenAM forgot password self-service flow ? 
OpenAM forgot password allows user to reset password after successfully completing various stages (such as KBA, email confirmation, reCaptcha etc). Unfortunately, the problem is that the account is not unlocked when this flow is used. There is already an open RFE for this issue.  

Solution

Versions used for this implementation: OpenAM 13.5, OpenDJ 3.5
One of the solution can include extending out of the box OpenAM's forgot password self-service flow by adding custom stage to unlock user's account: 

• Implement ForgottenPasswordConfigProviderExt to include account unlock stage. 
• Implement unlock custom stage
• Extend selfServiceExt.xml to include custom provider.

Deploy

• Build the custom stage by using maven.
• Delete all instances of User Self-Service from all realms.
• Remove existing selfService

./ssoadm delete-svc --adminid amadmin --password-file /tmp/pwd.txt -s selfService

• Restart OpenAM
• Register custom selfService
• Restart OpenAM

./ssoadm create-svc --adminid amadmin --password-file /tmp/pwd.txt --xmlfile ~/softwares/selfServiceExt.xml

• Add User Self-Service to specified realm and enable forgot password flow.

Testing

1. Lock user by authenticating using wrong password till user is locked out.
2. Follow forgot password flow to reset password and unlock account.
3. Try authenticating again with new password. This should succeed.

See Also

Get code
Understanding OpenAM and OpenDJ account lockout behaviors
Configuring OpenAM Account Lockout
Memory vs Physical OpenAM lockouts