Preventing "unavailable" (or locked) users from logging in

Question

So this seems like it should be simple to fix, but it's stumping me.
An admin has a user open on the admin screen at the same time that user logs in to the /idm/user interface. The user receives the "yellow box" error "Your account is unavailable at this time. Please try again later."
However, the login does not fail, and the user is sent to the menu page, executing any code that exists there. If there are any automated actions that kick off a workflow on that page (e.g., "force user to answer forgot password questions") this can easily put the user in an infinite loop, (they update their questions, the update fails, they return to the end user menu and are asked to enter the answers again).
We've tried putting in code that checks the value of waveset.locked and logs the user out if true, but that value never gets set to true.
Any suggestions on how to keep users out of the user interface when they are in this situation?

Answer 1

Thanks for the response.
Your description matches the behavior we see. But having our code unable to identify the locked status causes problems when you are trying to auto-update users.
E.g., when we create accounts, we put an expiration date on the account in the form of a deferred task that will disable the user's account at some future date. When the user logs in to IDM, our main form checks to see if the user has such an expiration date, and if so, runs a workflow to remove the deferred task. (This is to keep unclaimed accounts from sitting around active forever).
Our "code" looks like this:
<Field name='Automatically remove account expiration'>
        <Disable>
          [Check for expiration]
        </Disable>
        <Field>
          <Display class='Javascript'>
            <Property name='required'>
              <Boolean>false</Boolean>
            </Property>
            <Property name='script' value='[launch workflow to remove expiration]'/>
          </Display>
        </Field>
      </Field>If the user is locked, the workflow is launched, but of course it doesn't actually update the user (which is locked) and when it returns the user to the main page, the deferred task is still there, which kicks off the workflow again.
So the user gets the error that the account is locked, but in the meantime, their browser enters an infinite loop.
Another version of this error is if the user has had their password expired and logs in while their account is locked. The expired user form attempts to change the user's password, while the error stating "account unavailable" is shown.
So what we're looking for is a way to detect on the form (or in the workflows) that the user is locked, so we can avoid calling the workflow that's going to fail if they are locked. That said, we are open to other workarounds if you've got em!
Thanks again,