Problem/Motivation

A non-ldap user in an environment using mixed mode wants to reset his password using the Reset your password link on the user edit form.

Debug Report

  1. Create a new user using drush user:create testuser --password=********
  2. Login with the new user
  3. Enter the user edit form → you will see the Reset your password link nearby the password field
  4. Click on the link → Access forbidden

BTW: at the moment every authenticated user gets an Access denied, it is independent of the user's role.

Proposed resolution

Non-ldap user will be able to use the reset form.

Remaining tasks

Update \Drupal\ldap_authentication\Routing\RouteSubscriber::validateResetPasswordAllowed to allow access for a logged-in users who is not an ldap_user.

Data model changes

No

Issue fork ldap-3549930

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

Comments

rwam created an issue. See original summary.

rwam’s picture

Status: Active » Needs review

I've created a solution which works fine on our end. So would be great to get any feedback if it's suitable.