Summary

While troubleshooting issues around CAPTCHA in Bitbucket Server, the list of the blocked users and the process of resetting them can be achieved by the following steps.

Environment

Bitbucket 7.x,8.x

Solution

To Identify the users who are blocked by the CAPTCHA requirement, run the following query

SELECT us.user_name
FROM cwd_user_attribute as atr
JOIN cwd_user as us ON atr.user_id=us.id
WHERE atr.attribute_name = 'failedAuthenticationAttemptCount' AND atr.attribute_value >= '5';

If there are just a few users blocked, the following API is the option to reset the CAPTCHA for each one individually, else we would suggest developing a script using the list of users obtained from the database query. As guidance, here's a sample curl request to reset a user's CAPTCHA.

curl --user <admin_user_name>:<password> -X DELETE <base_url>/rest/api/1.0/admin/users/captcha?name=<user_name>

To reset CAPTCHA for all the users the database would need to be modified/updated manually. The following steps need to be implemented. 

• Backup Bitbucket
• Stop Bitbucket

• Run UPDATE like the following:

  UPDATE cwd_user_attribute
  SET attribute_value = 0, attribute_lower_value = 0
  WHERE attribute_name = 'failedAuthenticationAttemptCount';

• Restart Bitbucket