OpenAM account lockout does not work when naming attribute and LDAP Users Search Attribute are different

When different attributes are used for Authentication Naming Attribute and LDAP Users Search Attribute in a Data Store configuration, Account lockout does not lock the end user out after the set amount of failed attempts have happened.

To recreate

1. Set the LDAP Users Search Attribute to mail and Set the Authentication Naming Attribute to uid. To only be able to login with the uid the DN cache must also be disabled.

2. Enable account lockout by setting Login Failure Lockout Mode to true, set Login Failure Lockout Duration to 1 minute

3. Try to login in with a demo user with the wrong password, after failing the default 3 times, the use can still login with the correct password even though they should have been locked out

Work around 1: Ensure LDAP Users Search Attribute and Set the Authentication Naming Attribute match

Work around 2: Use LDAP module and set password policy in OpenDJ, this will also require the LDAP module's "Return User DN to DataStore" attribute to be set to false