Is it possible to check in user information whether a password has been set?

[HS7]

Hi
When SSO is enabled, probably set a password for users log in locally, but not for users log in with SSO.
Is it possible to check in user information whether a password has been set?

[Ankur Bawiskar]

@HS7 

Did I answer your original and subsequent question?

If my response helped please mark it correct and close the thread so that it benefits future readers.

[Ambuj Tripathi]

Hi @HS7 

If the password isn't set for the user, then the password field is empty in user table. However, there could be some exceptions for the OOB users and like admin and others, please double check.

For the SSO users, the password field doesn't get updated. If its already set, it doesn't update it or clears it out.

If you want sso users to not be able to login using the username and password even if they were able to set the password, then you can think of creating the post auth context policy in Adaptive Authentication feature.

Thanks!

Ambuj

[HS7]

Hi @Ambuj Tripathi 

For SSO login users, the "password" column in the sys_user table should be empty.
And I think it should be prevented from setting a password using the password reset.
Is there a solution?

[Ambuj Tripathi]

Hi @HS7 

It doesn't really matters whether the password field is set or not for the SSO users. The sso users (in your case users without admin role) will not be able to do the local login once you configure and enable the Adaptive Authentication policy correctly.

I think sso users can still change their passwords, and there is no provision to prevent it OOB. But even if they are able to set their passwords, they can't really login with username and password.

If you still want them to not allow to set their local login passwords, you can follow more simple and apt approaches -

1: Have a BR on sys_user table which checks the user role and prevents setting the password field if the user doesn't have admin role.

OR

2: Edit the UI action on the user profile page for change password and add the admin role there to make sure the change password UI action is only visible to admin users. However, if any admin user is logging in with SSO, then can see this UI action on their profile page.

Thanks!

[HS7]

Thank you @Ambuj Tripathi 

「SSO ユーザー (この場合、管理者ロールを持たないユーザー) は、アダプティブ認証ポリシーを正しく構成して有効にすると、ローカル ログインを実行できなくなります。」

具体的にどのような設定を行うべきか教えてください。