How can I lock down the self service portal? Users can't edit AD attributes.

Question

I am basically setting up the self service portal to only allow a user to reset thier own passwords.

Comments

Hello,

Have a look at the following tutorial: https://www.adaxes.com/tutorials_WebInterfaceCustomization_AllowDenyAccessToTheWebInterface.htm. On step 4, select option Deny access for all users. This way, nobody will be able to log in to the Web interface, but users will be able to use the Forgot your password? option on the sign in page to reset their forgotten passwords.

---

I need users to log in to be able to enrole in password self service. This option would not solve my issue. My issue is a user can log in and change attributes on thier account in AD, Attributes we are going to use in the future which can not be modified by end users like Phone numbers, notes, and other stuff.

I tried to remove from the self service view in the management area:

I also set access on using a Adaxes security group. And set the access in the web configurator. Yet my test user can update the fields

---

Hello,

Do we understand correctly that you want to prohibit users from modifying any properties in the Web interface? If not, please, describe the desired behaviour in all the possible details with live examples.

---

Yes that is exactly what I need. They should be able to log in so they can enrole in password self service and reset their password if they chose. Other wise they can see their attributes but not be able to modify them.

Answer 1

Hello,

Thank you for clarifying. To achieve the desired, please, do the following:

• Disable the Edit operation for the Web interface: https://www.adaxes.com/tutorials_WebInterfaceCustomization_DisallowCertainOperationsOnADObjects.htm.
• Disable displaying the Edit button for all sections in the Web interface forms for all types of objects. Pay attention that the forms can be different for the logged on user (My Account option) and other users (User option).

Comments

User still sees the edit button and can edit the properties.

---

Hello,

As we mentioned in the previous post, it should be done for all sections. According to your screenshot, the button was disabled for the General section, but is displayed for the Personal Information one.

---

Perfect, thank you.