I known that with grace login even expired or all taken, you can still
reset your password with the challenge response set throught the password
portlet. Is there a way to make it work with intruder lockout ? or is it
working as design ?

Any ideas.

Regards