Disable changing photo

Question

In the SelfService portable users are able to edit some settings, but I don't want them to change their photo. They may view them only, how to accomplish this? I've searched through a lot off settings but was not able to find this one...

With regards,

Remco

Answer 1

Hello Remco,

The permission to update certain properties of the users' own accounts is granted by the built in Security Role called User Self-Service. By default, it is assigned to Self and includes All objects in the Assignment Scope, which means that the permissions granted by the Role are granted to all users and apply to the users' own accounts.

The Allow Write Personal Information permission granted by the Role includes the permission to update the Picture property. To disallow users to change their own photos, you can add a permission to the User Self-Service Role that denies the right to update the Picture property. Since 'Deny' permissions always override 'Allow' permissions, users will no longer be able to update their own pictures. To do this:

1. Launch Adaxes Administration Console.
2. Expand the service node that represents your Adaxes service.
3. Navigate to Configuration \ Security Roles \ Builtin.
4. Select the User Self-Service Role.
5. Right-click in the Result Pane (located to the right) and click Add.
   
6. Select the User object type.
7. In the Property-specific permissions section, select the Write 'Picture' property permission in the Deny column.
   
8. Click OK and save the Security Role.