Can I prevent select accounts with expired passwords from being able to change it in the web interface?

Question

We have some accounts that we would like to prevent from changing their password on login when it is expired. This is because we have saml setup on individual interface pages but it won't redirect if the password is expired, it will ask them to change it. This is a bit of a loophole for us as we require dual factor and use saml to accomplish this.

Comments

Hello Mark,

Sorry for the confusion, but we are not quite sure what exactly you mean regarding the redirect. Could you, please, post here or send us (support@adaxes.com) screenshots of the pages faced by a user with expired password when they attempt to log in?

---

I don't have any screenshots but we setup saml on the web interface. We only have it setup though on certain web interfaces and not on the common sign in. We are using Azure for our saml setup which means it redirects to azure for authentication.

Answer 1

Hello Mark,

Thank you for clarifying. Unfortunately, there is no possibility to interfere the process in any way for any type of users. The setting is global for the Web interface and whoever attempts to login will be taken to the SAML identity provider.

Comments

We are not trying to interfere with the saml. We are trying to prevent password changes through the web interface when the password has expired. It is not sending them to the saml provider but allowing a password change.

---

Hello Mark,

Sorry for the confusion, but we are not sure what exactly you mean. When SAML SSO is enabled for a Web interface, Adaxes sign in page is not displayed for login to the Web interface. Instead, users directly get to the SAML identity provider page. If password change is requested after entering credentials of a user with expired password there, that is not something we can assist you with as it is not a part of Adaxes. However, the SAML identity provider support team might be able to help you with the corresponding settings.

If you face the below after entering credentials of a user with expired password, this behavior is be design and cannot be changed.

---

Thank you for confirming that it can not be changed.

FYI. The common sign-in does not change to the SAML identity provider page if you enable SAML for specific interface pages.

---

Hello Mark,

This behavior is expected. It is only possible for a Web interface to use the sign in settings of the Common Sign In page, but not vise versa.