[Feature Request]: Ability to prevent user password changes

[designatedsuccessor]

Is your feature request related to a problem? Please describe.

When using SCIM and SAML, there is no need for user password changes.

Describe the solution you'd like

Ability for admins to disable password changes and all password-change entry points.

It was said that was delivered as part of #14683 , but I'm not seeing it.

Describe alternatives you've considered

No response

Additional context

No response

[snipe]

I think this would really be handled already by turning on the LDAP Sync. If you don't have LDAP enabled, it should hide all of the password interfaces.

(It's just phrased a little awkwardly.)

[designatedsuccessor]

I think this would really be handled already by turning on the LDAP Sync. If you don't have LDAP enabled, it should hide all of the password interfaces.

(It's just phrased a little awkwardly.)

We don't use LDAP at all and can see the password pages and buttons. We use SAML and SCIM.

[designatedsuccessor]

I think this would really be handled already by turning on the LDAP Sync. If you don't have LDAP enabled, it should hide all of the password interfaces.

(It's just phrased a little awkwardly.)

Following up on this. So if I'm using SAML and SCIM, and not using LDAP at all, should users not be seeing the change-password buttons?

[designatedsuccessor]

Hi @snipe just looking at this again. Should I not see password-change buttons when using SAML?

[cevallose]

Is there any updated with this problem?

[cevallose]

@designatedsuccessor did you find a way to do this?

[designatedsuccessor]

@designatedsuccessor did you find a way to do this?

No I did not. I don't think the Snipe-IT people even really understand the issue despite repeated attempts to educate so we gave up. Typical enshittification.

[cevallose]

I foud I way to do it but in MariaDb , Are you using a db??

[mdvdhurk]

Hi! If I understand correctly, reading #15014 (comment) this would mean that:
If I have an active/switched on LDAP sync, a user logging in using credentials via LDAP, they should not see 'change password' in their profile?

I'm on 7.0.10, which is newer than the referred introduction of disabling this. I have disabled profile edits, and indeed, the buttons to edit profiles are gone, but referring to passwords, users logging in still see the options to change password:

Can you please have another look at this? Thanks!

[designatedsuccessor]

The Snipe people don't seem to know that LDAP is an old, decrepit protocol that no self-respecting organization should be using for modern auth, so from their perspective you're crazy for not just using LDAP and have password-change ability function. SAML and SSO are obviously more secure and Snipe reluctantly offers it, but they obviously put zero thought into turning off the password stuff with it. Security isn't Snipe's forte...more of an afterthought. It's an inventory management interface first, security second.

[snipe]

@designatedsuccessor The user already cannot save their password if they were imported via LDAP, and we really don't need the attitude.

snipe-it/app/Http/Controllers/ProfileController.php

Lines 118 to 120 in 7f5ea30

	if ($user->ldap_import == '1') {
	return redirect()->route('account.password.index')->with('error', trans('admin/users/message.error.password_ldap'));
	}

As you can see, it never actually gets saved if the user was imported via LDAP.

LOTS of people still use LDAP.

SAML and SSO are obviously more secure and Snipe reluctantly offers it
so from their perspective you're crazy for not just using LDAP and have password-change ability function

We always encourage IT Departments to transition to SCIM/SAML, but we cannot force the hands of the IT departments that use us.

Security isn't Snipe's forte...more of an afterthought.

Sure, bro. 🙄

If you're not going to be helpful, maybe consider keeping your uninformed opinions to yourself. Nobody is forcing you to use this free software.

[snipe]

@mdvdhurk - we already don't allow the password change to save. I'm working on a PR that will hide those elements for users who are LDAP. It gets a bit harder with SCIM and SAML, since we don't really have a way of knowing which users are SCIM and SAML, but even if they do change their password, it won't really affect anything, since SAML will redirect away from the regular login anyway.

[snipe]

@mdvdhurk this PR might help: #16091

[mdvdhurk]

Thanks, appreciated! :)