In some instances 'lastFailure' is missing from user brute force status

Before reporting an issue

• I have read and understood the above terms for submitting issues, and I understand that my issue may be closed without action if I do not follow them.

Area

authentication

Describe the bug

Troublesome code:

DefaultBruteForceProtector#failure

    long last = userLoginFailure.getLastFailure();
    long deltaTime = 0;
    if (last > 0) {
        deltaTime = failureTime - last;
    }
    userLoginFailure.setLastFailure(failureTime);

    if (!(realm.isPermanentLockout() && realm.getMaxTemporaryLockouts() == 0) && deltaTime > 0) {
        // if last failure was more than MAX_DELTA clear failures
        if (deltaTime > (long) realm.getMaxDeltaTimeSeconds() * 1000L) {
            userLoginFailure.clearFailures();
        }
    }
    userLoginFailure.incrementFailures();
    logger.debugv("new num failures: {0}", userLoginFailure.getNumFailures());

This sets last failure time to T2 and further clears it in userLoginFailure.incrementFailures()

This causes that for n = 1, lastFailure is null and lastFailure is not displayed in api as it is null for this case.

Version

26.3.2

Regression

• The issue is a regression

Expected behavior

brute force status features following attributes:

locked: false
failureCount
lastFailure

Actual behavior

brute force status features following attributes:

locked: false
failureCount

lastFailure is missing

How to Reproduce?

Preconditions: A user in blockes status exists in the system.

Steps:

1. Check brute force status of user from preconditions to verify their status,
2. Log in using user from preconditions by providing the proper login and password
3. Remove the brute force status from the user from preconditions
4. Repeat step 1

Anything else?

No response