How can I prevent users from changing password?

cgubi

Good Morning,I am using Osticket 1.9.1.5 with the LDAP plugin, and I would like to prevent the users to change their password, because the passwords for LDAP access are managed elsewhere in the active directory.I unchecked the option "ALLOW PASSWORD RESETS" in the settings/access configuration page, but nevertheless on the profile settings the fields to change the password are still present (see attached screenshot). Is this normal?Thanks in advance for your support.This is my current configuration:osTicket Versionv1.9.5.1 (1faad22)Web Server SoftwareApache/2.4.10 (Win32) OpenSSL/1.0.1i PHP/5.6.3MySQL Version5.6.21PHP Version5.6.3

cgubi

blank

ntozier

osT doesn't update their password in LDAP.So them updating their password in osT would only result in their local password in osT being changed.i.e. it is only used if for some reason the user cannot auth against LDAP and they are allowed to auth locally in their account.The feature that you are disabling has nothing to do with the user's profile. It determines if the user fails to log in if the "reset password" link is made available to them.

cgubi

Thank you NtozierIf i well understood, the only way to disable this feature to prevent accidental changes of password from users is to comment the corresponding PHP code. Am I right?

nick_mccann

Agent > Users > User Directory Click the user's name. Then click the Manage Account button near the upper right. Click the "Manage Access" tab in the window that pops up. Check the box "User cannot change password"You'll have to do this for each user, but can be done when registering them.

cgubi

Thank you,The problem is that the users are registered automagically with their LDAP logon, so a global disabling option would be very useful. Can you consider to add it to OSticket?

Chefkeks

We "simply" solved that by creating an apache redirect. Since we use SSO (ldap auth + http passthru auth plugin) there is no need to change their password, so we added an apache redirect and everything is ok

cgubi

The problem is that the password change is in the user profile page. What if they go to their profile page and change the password accidentally? I think that the change of password should be disabled when using LDAP authentication.