<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">Hi,<br>
<br>
On 07/15/2016 09:03 PM, Florin. Stingaciu wrote:<br>
</div>
<blockquote
cite="mid:CAMQHPY0sur6eepkBPwUW=ACACoOguezK9--ATtndSFTqGsBuGw@mail.gmail.com"
type="cite">
<div dir="ltr"><b>Users changing their password</b>
<div>When using SSO, users no longer have a password associated
with their midPoint account. However, we'd still like to allow
users to change their passwords for their accounts on a
resource. Unfortunately we can't utilize the Credentials page
as the page will request for your old password -- which
doesn't exist. Right now, I had to resort to using the
authorization rules to allow end users to modify their
password directly on the Projection. This process is not very
intuitive, especially when the user doesn't have a password
set up on the account at all (they have to click the "show
empty fields") </div>
<div><br>
</div>
<div>Ideally, the fact that SSO is enabled should generate a
different credentials page that lets you change your password
on an account of your choosing without asking for the old
password.</div>
</div>
</blockquote>
<br>
We already have setting for that: <br>
<br>
<a class="moz-txt-link-freetext" href="https://github.com/Evolveum/midpoint/blob/master/samples/objects/security-policy-password.xml">https://github.com/Evolveum/midpoint/blob/master/samples/objects/security-policy-password.xml</a><br>
<br>
see passwordChangeSecurity<br>
<br>
Unfortunately, it is currently documented only in the schema
(common-core-3.xsd).<br>
<br>
<blockquote
cite="mid:CAMQHPY0sur6eepkBPwUW=ACACoOguezK9--ATtndSFTqGsBuGw@mail.gmail.com"
type="cite">
<div dir="ltr">
<div><b>End Users </b></div>
<div>Another issue we found was that when a user tries to access
midPoint and doesn't have the End User role while SSO is in
place, the server spits back a 500 error. Ideally, an error
message should be generated letting the user know that he
lacks authorization to access the midPoint GUI. <br>
</div>
</div>
</blockquote>
<br>
Yes, it should be 401 and not 500. Please file a bug report for
that.<br>
<br>
<pre class="moz-signature" cols="72">--
Radovan Semancik
Software Architect
evolveum.com
</pre>
</body>
</html>