title: How to reset AccessFailedCount automatically after specified time in Identity Server 4
body: <p>I have a legacy application which is authenticating the user using as Identity Server 2. Where we are locking the user account after N number of failed attempts by updating below fields:</p>
  
  <ul>
  <li><strong>FailedPasswordAttemptCount</strong></li>
  <li><strong>IsLockedOut</strong></li>
  <li><strong>LastLockoutDate</strong></li>
  <li><strong>FailedPasswordAttemptWindowStart</strong></li>
  </ul>
  
  <p>Now we are migrating from Identity Server 2 to 4 and I realized that new [AspNetUsers] table structure doesn't have all these fields. It contains only three fields as below:</p>
  
  <ul>
  <li><strong>LockoutEnabled:</strong> It specifies whether a user has opted for lockout or not.</li>
  <li><strong>AccessFailedCount:</strong> This fields gets incremented on each unsuccessful login attempts.</li>
  <li><strong>LockoutEnd:</strong> It specifies the locking timespan in minutes.</li>
  </ul>
  
  <p>As I already told you that in IdServ4 [AspNetUsers].AccessFailedCount will increment on each unsuccessful attempts and after <strong>MaxFailedAccessCount</strong> it will reset the count to 0 and Set <strong>LockoutEnd</strong> with specified time span (As configured in startup file).</p>
  
  <pre><code>services.AddIdentity&lt;ApplicationUser, IdentityRole&gt;(options =&gt;
             {
                 options.Lockout.MaxFailedAccessAttempts = 3;
                 options.Lockout.DefaultLockoutTimeSpan = 15;
             })
  </code></pre>
  
  <p>After all this background information now I coming to my actual issue.</p>
  
  <p>Let's suppose user visits our login page and made 2 unsuccessful login attempts and closed the browser and left for the day and then revisit our site a few days later and tries one more unsuccessful attempt now he crossed MaxFailedAccessCount and then his account gets locked (Code is written in Identity Server library) but as per user view he made only one unsuccessful attempt.  </p>
  
  <p><strong>What I am trying to do:</strong></p>
  
  <p>As I am not using EntityFramework for database interaction and written own Stored Procedures for it and implemented all stores myself so I can introduce LastAccessFailedDate field in [AspNetUsers] table and compare it with current date time when the user made an unsuccessful login attempt and if it's less than configured timespan I will just reset AccessFailedCount to 1 and existing value +1;</p>
  
  <p><strong>Original Code:</strong></p>
  
  <pre><code>public Task&lt;int&gt; IncrementAccessFailedCountAsync(TUser user, CancellationToken cancellationToken)
          {
              user.ThrowIfNull(nameof(user), cancellationToken);
              return Task.FromResult(++user.AccessFailedCount);
          }
  </code></pre>
  
  <p><strong>My Approach:</strong></p>
  
  <pre><code>public Task&lt;int&gt; IncrementAccessFailedCountAsync(TUser user, CancellationToken cancellationToken)
          {
              user.ThrowIfNull(nameof(user), cancellationToken);
              // Lets suppose _configuredResetTime configured to 60 minutes
              If(user.LastAccessFailedDate &gt; DateTime.Now.AddMinutes(_configuredResetTime))
              {
                user.AccessFailedCount += 1;
              }
              else
              {
               user.AccessFailedCount = 1;             
              }
           user.LastAccessFailedDate = DateTime.Now;
           return Task.FromResult(user.AccessFailedCount);
          }
  </code></pre>
  
  <p><strong>Note:</strong> I am not sure whether there is an alternative which has been provided by IdServ4 library or do I need to implement it myself.</p>
  
  <p><strong>Expected result:</strong></p>
  
  <p>So I am wondering can we reset AccessFailedCount after configured timespan if a user is not active on login screen like we do in IdServ2 using [aspnet_Users].FailedPasswordAttemptWindowStart field.</p>
  
  <p><strong>Any suggestions are welcome, Thanks!</strong></p>