Index: java/org/apache/catalina/Realm.java
===================================================================
--- java/org/apache/catalina/Realm.java	(revision 1763785)
+++ java/org/apache/catalina/Realm.java	(working copy)
@@ -231,4 +231,13 @@
      * @return principal roles
      */
     public String[] getRoles(Principal principal);
+
+
+    /**
+     * Return the availability of the realm for authentication.
+     * @return <code>true</code> if the realm is able to perform authentication
+     */
+    default public boolean isUp() {
+        return true;
+    }
 }
Index: java/org/apache/catalina/realm/CombinedRealm.java
===================================================================
--- java/org/apache/catalina/realm/CombinedRealm.java	(revision 1763785)
+++ java/org/apache/catalina/realm/CombinedRealm.java	(working copy)
@@ -418,4 +418,15 @@
         throw uoe;
     }
 
+
+    @Override
+    public boolean isUp() {
+        for (Realm realm : realms) {
+            if (!realm.isUp()) {
+                return false;
+            }
+        }
+        return true;
+    }
+
 }
Index: java/org/apache/catalina/realm/JNDIRealm.java
===================================================================
--- java/org/apache/catalina/realm/JNDIRealm.java	(revision 1763785)
+++ java/org/apache/catalina/realm/JNDIRealm.java	(working copy)
@@ -2379,6 +2379,13 @@
 
     }
 
+    
+    @Override
+    public boolean isUp() {
+        // Simple best effort check
+        return (context != null);
+    }
+
     private DirContext createDirContext(Hashtable<String, String> env) throws NamingException {
         if (useStartTls) {
             return createTlsDirContext(env);
Index: java/org/apache/catalina/realm/LockOutRealm.java
===================================================================
--- java/org/apache/catalina/realm/LockOutRealm.java	(revision 1763785)
+++ java/org/apache/catalina/realm/LockOutRealm.java	(working copy)
@@ -212,7 +212,7 @@
      */
     private Principal filterLockedAccounts(String username, Principal authenticatedUser) {
         // Register all failed authentications
-        if (authenticatedUser == null) {
+        if (authenticatedUser == null && isUp()) {
             registerAuthFailure(username);
         }