The user entries in the IdM LDAP database utilize standard and custom schema attributes to track authentication status. The two primary attributes relevant to account locking are:

ipa user-unlock [login]

By mastering ipa user-unlock , you can ensure minimal downtime for your team while maintaining the robust security posture provided by FreeIPA. Administrators_Guide — FreeIPA documentation

This reset allows the KDC to treat the next authentication attempt as the "first" attempt regarding lockout policy, immediately granting the user the ability to obtain a Kerberos ticket (assuming the correct password is provided).

Best practice dictates verifying the reset immediately: