Bug: [IMAP] too many login attempts using the old password
Status: RESOLVED
Priority: --
Resolution: FIXED
Created: 2022-05-06 04:54:07+00:00
Resolved: 2023-10-31 02:50:44+00:00

Steps to reproduce:

I changed the password for my imap account 2 days ago, while Thunderbird was not running and my Mac was switched off.


Actual results:

On the first run of Thunderbird after the password change it tried the old password 6 times within a few seconds and got me locked out for 10 minutes. Logfile entries on the imap server:
```
May  6 06:17:03 srvvm01 auth[238025]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=harri rhost=10.19.97.250  user=harri
May  6 06:17:03 srvvm01 auth[238037]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=harri rhost=10.19.97.250  user=harri
May  6 06:17:03 srvvm01 auth[238037]: pam_sss(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=harri rhost=10.19.97.250 user=harri
May  6 06:17:03 srvvm01 auth[238037]: pam_sss(dovecot:auth): received for user harri: 6 (Permission denied)
May  6 06:17:03 srvvm01 auth[238025]: pam_sss(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=harri rhost=10.19.97.250 user=harri
May  6 06:17:03 srvvm01 auth[238025]: pam_sss(dovecot:auth): received for user harri: 6 (Permission denied)
May  6 06:17:09 srvvm01 auth[238025]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=harri rhost=10.19.97.250  user=harri
May  6 06:17:09 srvvm01 auth[238025]: pam_sss(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=harri rhost=10.19.97.250 user=harri
May  6 06:17:09 srvvm01 auth[238025]: pam_sss(dovecot:auth): received for user harri: 6 (Permission denied)
May  6 06:17:13 srvvm01 auth[238025]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=harri rhost=10.19.97.250  user=harri
May  6 06:17:13 srvvm01 auth[238025]: pam_sss(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=harri rhost=10.19.97.250 user=harri
May  6 06:17:13 srvvm01 auth[238025]: pam_sss(dovecot:auth): received for user harri: 6 (Permission denied)
May  6 06:17:17 srvvm01 auth[238037]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=harri rhost=10.19.97.250  user=harri
May  6 06:17:17 srvvm01 auth[238037]: pam_sss(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=harri rhost=10.19.97.250 user=harri
May  6 06:17:17 srvvm01 auth[238037]: pam_sss(dovecot:auth): received for user harri: 8 (Insufficient credentials to access authentication data)
May  6 06:17:21 srvvm01 auth[238025]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=harri rhost=10.19.97.250  user=harri
May  6 06:17:21 srvvm01 auth[238025]: pam_sss(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=harri rhost=10.19.97.250 user=harri
May  6 06:17:21 srvvm01 auth[238025]: pam_sss(dovecot:auth): received for user harri: 8 (Insufficient credentials to access authentication data)
```
There was a popup asking for the new password, but this did not help me to bypass the locked account. Too late. And there was no indication *why* I could not login.

I verified that the password entry in Thunderbird's autofil contained the new password. There were no other entries.


Expected results:

TB should try the known password *once*. If this fails, then the popup should be shown. Further login attempts using the bad password should not be tried.