urllib/urllib2 AbstractDigestAuthHandler is hardcoded to 5 retries (self.retried). Normally this wouldn't be an issue. Certain products link basic HTTP auth to Active Directory (yes, this shouldn't be a thing). When you have a failed login attempt lockout set on AD, this will lockout accounts on the very first failed Python basic auth attempt, if the AD lockout is set to 5 or less. In my specific use case, I was able to override request.HTTPBasicAuthHandler.__init__() and request.HTTPBasicAuthHandler.reset_retry_count() by setting self.retried=5. One way to fix this would be to add a new retry_count argument to AbstractDigestAuthHandler. I am a bit busy at the moment, but will submit a patch as soon as I get time.
For (convoluted) background, see issue 8797. A solution that uses a new would be a new feature and could only go in 3.7, but perhaps the solutions in the above issue will point to a backward compatible solution.
It is a very limited use case; I won't gripe about 3.7+ only support. At the end of the day, even shown in the comments of that class, it shouldn't be set to a static 5 count. At least this is a very easy patch that won't affect existing code.
