Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I'm using the wpDirAuth plugin to allow LDAP logins and automatic account creation. One snag I've run into is LDAP users can still request a password reset. They receive the email with the link, but the link says the key is invalid. So it's good that it doesn't attempt to change their password.

However, I would like to prevent them from the email ever being sent and instead a message saying "Sorry, your account password cannot be changed on this site. Please contract IT Service Desk" upon form submission.

Is there a hook I can use once the form is submitted to check if the account is LDAP (I could check for the company email address to identify LDAP accounts) and return the error message?

share|improve this question
    
Are you using the default lost password link provided in WordPress ? –  Subharanjan Dec 14 '13 at 14:02
    
Yes, I'm pretty sure wpDirAuth hooks in to existing login/registration/lost password methods albeit on new pages. –  Chris Dec 14 '13 at 15:59
add comment

1 Answer

up vote 1 down vote accepted

Code for checking and blocking LDAP users to reset password.

/**
 * Checks whether a user is LDAP user and restricts to reset password.
 *
 * @param  bool   $allow    Whether the password can be reset.
 * @param  int    $user_id  The ID of the user.
 * @return bool|WP_Error
 */
function ldap_restrict_password_reset( $allow, $user_id ) {

    $user = get_user_by( 'id', $user_id );
    if ( ! empty( $user ) ) {
        $user_login   = stripslashes( $user->data->user_login );
        $user_email   = stripslashes( $user->data->user_email );

        // check if the user a LDAP user
        if( $user_email === 'xxxxxxxxxxxxxxxx@yyyyyyyyy.zzzzzzz' ) {
            return new WP_Error('no_password_reset', __('Password reset is not allowed for this LDAP user on this site.'));
        }
    }

    return $allow;
}
/* Filters whether the user's password can be reset. */
add_filter( 'allow_password_reset', 'ldap_restrict_password_reset', 10, 2 );

Note: Please add code to get and check if the user is a LDAP user or not.

=========================================================

These are some of the hooks that you can use to stop sending email and show error message.

/**
 * Fires before a new password is retrieved.
 *
 * @since 1.5.1
 *
 * @param string $user_login The user login name.
 */
do_action( 'retrieve_password', $user_login );

/**
 * Filter whether to allow a password to be reset.
 *
 * @since 2.7.0
 *
 * @param bool true           Whether to allow the password to be reset. Default true.
 * @param int  $user_data->ID The ID of the user attempting to reset a password.
 */
$allow = apply_filters( 'allow_password_reset', true, $user_data->ID );

if ( ! $allow )
    return new WP_Error('no_password_reset', __('Password reset is not allowed for this user'));
else if ( is_wp_error($allow) )
    return $allow;

Above is part of the code taken from wp-login.php file. http://wpseek.com/retrieve_password/

share|improve this answer
    
great info, but can you please supply a small snippet of a code that actually should block password reset? this is not trivial for people which are not very familiar with using filters –  Mark Kaplun Dec 14 '13 at 14:26
    
Updated my answer above. –  Subharanjan Dec 14 '13 at 14:47
    
Thanks, Subharanjan. The code looks great! I'm away from the office now, but will try it out first thing Monday :-) –  Chris Dec 14 '13 at 16:01
1  
Thanks, Subharanjan. Your code works perfectly :) One slight alteration was to make it check the email for the institution domain rather than a specific user: // check if the user a LDAP user if (strpos(strtolower($user_email),'domain') !== false) { return new WP_Error('no_password_reset', __('Password reset is not allowed for this LDAP user on this site.')); } –  Chris Dec 16 '13 at 8:46
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.