PUBLIC - Liferay Portal Community Edition
  1. PUBLIC - Liferay Portal Community Edition
  2. LPS-30036

Allow admins to block users to update their details when imported from LDAP

    Details

    • Similar Issues:
      Show 4 results 

      Description

      When LDAP authentication / import is enabled in Liferay, users should not be allowed to change and save their details in My Account. Their details will be overridden with values from LDAP, either when user is bulk-imported or logs in again. The same behavior may be added to Users Administration, as updating user details here also does not make sense.

      As not all users may be imported from LDAP, the feature should be configurable on per user basis. E.g. add portal config property listing email domains, that should / should not be blocked. Example:

      (1) users imported from LDAP have emails with @liferay.com or @sf.net, those should not be allowed to change their details, any other user can update details:

      user.details.update.enabled.whitelist=*
      user.details.update.enabled.blacklist=liferay.com,sf.net

      (2) Customer has external users in their Liferay DB (all with external-company.com emails) and imports internal users from LDAP (users have many email domains assigned). Only external users can update their details.

      user.details.update.enabled.whitelist=external-company.com
      user.details.update.enabled.blacklist=

      As LDAP import may be customized, it would also be good to allow admins to configure which fields should be blocked for LDAP imported users, like:

      user.details.ldap.field.blocked[com.liferay.portal.model.User.prefix]=true
      user.details.ldap.field.blocked[com.liferay.portal.model.User.firstName]=true
      user.details.ldap.field.blocked[com.liferay.portal.model.User.middleName]=true

      This may be integrated with / added to existing feature:

      field.enable.com.liferay.portal.model.Contact.male=true
      field.enable.com.liferay.portal.model.Contact.birthday=true
      field.enable.com.liferay.portal.model.Organization.status=false

      1. Attachment 1.png
        77 kB
      2. Attachment 2.png
        77 kB
      3. Attachment 3.png
        48 kB

        Issue Links

          Activity

          Hide
          Randy Zhu added a comment -

          In preparation for Ideation; we are merging New Feature and Improvement tickets into a singular ticket type called “Feature Request”.

          This ticket has been converted to story ticket type for you; so that the ticket may continue to progress through the workflow properly.

          However these tickets were not writing in the proper story format. Please format this ticket to story standards.

          Show
          Randy Zhu added a comment - In preparation for Ideation; we are merging New Feature and Improvement tickets into a singular ticket type called “Feature Request”. This ticket has been converted to story ticket type for you; so that the ticket may continue to progress through the workflow properly. However these tickets were not writing in the proper story format. Please format this ticket to story standards.
          Hide
          David Truong added a comment -

          Can we get a better error description instead of saying you don't have permission to edit it? Seems more appropriate to say "This user is imported from LDAP. Please change the user from using through your LDAP." or something similar.

          Show
          David Truong added a comment - Can we get a better error description instead of saying you don't have permission to edit it? Seems more appropriate to say "This user is imported from LDAP. Please change the user from using through your LDAP." or something similar.
          Hide
          David Truong added a comment -

          Error message will display "Your portal admin has disabled the ability to change the following fields: ... " since there are numerous portal.properties that can disable the field.

          Show
          David Truong added a comment - Error message will display "Your portal admin has disabled the ability to change the following fields: ... " since there are numerous portal.properties that can disable the field.
          Hide
          Sharon Choi added a comment -

          PASSED Manual Testing following the steps in the description.

          Fixed on:
          Tomcat 7.0 + MySQL 5. Portal master GIT ID: cdf244c828f99209553e20c86ab5989dc16d906c.

          Following the steps listed above, in Jonathan's comment, after setting those properties in the portal-ext file, admins are allowed to block users from updating their details regardless of being imported from LDAP or not. No errors appear on the console, and everything appears to be working successfully.

          Show
          Sharon Choi added a comment - PASSED Manual Testing following the steps in the description. Fixed on: Tomcat 7.0 + MySQL 5. Portal master GIT ID: cdf244c828f99209553e20c86ab5989dc16d906c. Following the steps listed above, in Jonathan's comment, after setting those properties in the portal-ext file, admins are allowed to block users from updating their details regardless of being imported from LDAP or not. No errors appear on the console, and everything appears to be working successfully.

            People

            • Votes:
              0 Vote for this issue
              Watchers:
              6 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved:

                Development

                  Structure Helper Panel