I know this has been discussed in the past years ago now such as here, but is there a way yet that users can be prevented from using self sign up via email confirmation or attempting to change their password (which won't work) when Active Directory LDAP authentication is being used ?

I only want Active Directory LDAP authenticated users to be able to log in, I don't want other random people who can email the helpdesk email address to be able to sign themselves up and then be able to access things such as the knowledge base for example.

Changing registration method to private doesn't solve the issue - while it prevents random people from doing self sign up it also prevents Active Directory LDAP accounts from being "auto-created" on the fly the first time they authenticate, and I have no desire to manually import users via CSV etc when the auto-creation via LDAP works just fine.

Has anyone found a solution to this ? About all I can think of so far is creating an IIS rewrite rule which will redirect attempts to go to account.php back to index.php so users can't actually use that page. (Deleting the page would be a bit harsh I think. 😀) Is this likely to work and not interfere with anything else ?

I don't particularly want people trying to edit their profiles either as their phone numbers etc are pulled from Active Directory as well so I don't see any need to allow access to account.php when users will be exclusively Active Directory LDAP users.

Has anyone else gone down this path of banning / redirecting access to account.php or found a better solution ?

Ok I've created a couple of simple rewrite rules for account.php and profile.php which solve the problem well enough - if anyone is interested I can share the rules.

    DBMandrake

    It's always helpful to the community to include your solution to a question.

    So if you will, Yes! please do share your solution on this thread so it can be archived properly!

    Best regards,
    Nick

      Sure. So I ended up creating two rewrite rules. The first one redirects any attempts to use the Sign Up page back to the login page:

      The second rule redirects any attempts to POST to the profile page back to the index page:


      By only redirecting POST attempts to profile.php it still allows the user to view their (LDAP sourced) profile, however any attempts to make changes such as a password change and submit those (which post back to the same script) just get redirected to the main index page without actually processing any changes.

      A bit of a kludge but it basically does what I set out to achieve.

      Write a Reply...