ipa pwpolicy --lockouttime=0 does not work as expected

Issue

If lockouttime is set to 'zero', ipa commands fails with "ipa: ERROR: Server is unwilling to perform: Entry permanently locked." error.

# ipa pwpolicy-mod --history=24 --maxlife=90 --minlife=0 --minlength=8 --minclasses=2 --lockouttime=0 --maxfail=5 --failinterval=1800

• Try any ipa as normal user.

Actual results:

ipa commands fails with following error.

"ipa: ERROR: Server is unwilling to perform: Entry permanently locked."

Expected results:

lockouttime=0 should not create any issues

From # ipa help pwpolicy-mod

  --failinterval=INT  Period after which failure count will be reset (seconds)
  --lockouttime=INT   Period for which lockout is enforced (seconds)