cf login command waits for user input after failed login with PASSWORD_LOCKED response

[n-losse]

Please fill out the issue checklist below and provide ALL the requested information.

• I reviewed open and closed github issues that may be related to my problem.
• I tried updating to the latest version of the CF CLI to see if it fixed my problem.
• I attempted to run the command with CF_TRACE=1 to help debug the issue.
• I am reporting a bug that others will be able to reproduce.

Describe the bug and the command you saw an issue with

When running cf login with supplied user and pw, and the pw is currently locked the login fails, but the CLI call does not exit. Instead, it presents a "Password: " prompt to the user.

When using this in a pipeline environment, this causes the task to hang until timed out, which is not useful.

Even when using this interactively, it makes no sense to prompt for a PW if the user is locked.

What happened

User got locked and pipelines got hung up until timeout.

Expected behavior

On failed login, cf login should immediately exit with a non-zero exit code.

Exact Steps To Reproduce

Lock your user e.g. by entering wrong PW sufficiently (5 times on SAP ID Service) , then run cf login
[note: verbose does not add anything here, so using regular output]

>cf login -a https://api.cf.eu12.hana.ondemand.com -u [email protected] -p "secret" -o myorg -s myspace
API endpoint: https://api.cf.eu12.hana.ondemand.com


Authenticating...
{"error":"invalid_grant","error_description":"User authentication failed: PASSWORD_LOCKED"}

Password: %

Provide more context

• MacOS 15.1.1 and Ubuntu on pipeline
• version of the CLI you are running: 8.9.0+c23186c.2024-12-02

[gururajsh]

Hi,

I tried to reproduce this issue and unable to. I'm CLI 8.9.0 as well on MAC. The prompt returns as shown below.

cli % cf login -u admin -p "test"
API endpoint: https://api.vast-3790616.z73c683e6.test.com


Authenticating...
Your account has been locked because of too many failed attempts to login.

API endpoint:   https://api.vast-3790616.z73c683e6.test.com
API version:    3.181.0
Not logged in. Use 'cf login' or 'cf login --sso' to log in.
Unable to authenticate.
FAILED
cli %

Can you provide more info?

[n-losse]

That is strange. It still happens exactly the same for me

with
API endpoint: https://api.cf.eu12.hana.ondemand.com
API version: 3.185.0

The IDP in question is the BTP Default IDP, SAP ID.

[n-losse]

Here's the last request output with CF_TRACE=1

Authenticating...
REQUEST: [2025-02-03T16:55:06+01:00]
POST /oauth/token HTTP/1.1
Host: login.cf.eu12.hana.ondemand.com
Accept: application/json
Authorization: [PRIVATE DATA HIDDEN]
Connection: close
Content-Type: application/x-www-form-urlencoded
User-Agent: cf/8.9.0+c23186c.2024-12-02 (go1.23.1; arm64 darwin)
[PRIVATE DATA HIDDEN]

RESPONSE: [2025-02-03T16:55:06+01:00]
HTTP/1.1 401 Unauthorized
Cache-Control: no-store
Content-Security-Policy: script-src 'self'
Content-Type: application/json
Date: Mon, 03 Feb 2025 15:55:06 GMT
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload;
Www-Authenticate: Basic realm="UAA/client", error="unauthorized", error_description="Bad credentials"
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-Vcap-Request-Id: 176f2152-6a7c-4c19-6ac2-e33b2a30d9a9
X-Xss-Protection: 1; mode=block
{
  "error": "invalid_client",
  "error_description": "{\"error\":\"invalid_grant\",\"error_description\":\"User authentication failed: PASSWORD_LOCKED\"}"
}


{"error":"invalid_grant","error_description":"User authentication failed: PASSWORD_LOCKED"}

Password:```