I'm using the wpDirAuth plugin to allow LDAP logins and automatic account creation. One snag I've run into is LDAP users can still request a password reset. They receive the email with the link, but the link says the key is invalid. So it's good that it doesn't attempt to change their password.

However, I would like to prevent them from the email ever being sent and instead a message saying "Sorry, your account password cannot be changed on this site. Please contract IT Service Desk" upon form submission.

Is there a hook I can use once the form is submitted to check if the account is LDAP (I could check for the company email address to identify LDAP accounts) and return the error message?

  • Are you using the default lost password link provided in WordPress ? Dec 14, 2013 at 14:02
  • Yes, I'm pretty sure wpDirAuth hooks in to existing login/registration/lost password methods albeit on new pages.
    – Chris
    Dec 14, 2013 at 15:59

1 Answer 1


Code for checking and blocking LDAP users to reset password.

 * Checks whether a user is LDAP user and restricts to reset password.
 * @param  bool   $allow    Whether the password can be reset.
 * @param  int    $user_id  The ID of the user.
 * @return bool|WP_Error
function ldap_restrict_password_reset( $allow, $user_id ) {

    $user = get_user_by( 'id', $user_id );
    if ( ! empty( $user ) ) {
        $user_login   = stripslashes( $user->data->user_login );
        $user_email   = stripslashes( $user->data->user_email );

        // check if the user a LDAP user
        if( $user_email === '[email protected]' ) {
            return new WP_Error('no_password_reset', __('Password reset is not allowed for this LDAP user on this site.'));

    return $allow;
/* Filters whether the user's password can be reset. */
add_filter( 'allow_password_reset', 'ldap_restrict_password_reset', 10, 2 );

Note: Please add code to get and check if the user is a LDAP user or not.


These are some of the hooks that you can use to stop sending email and show error message.

 * Fires before a new password is retrieved.
 * @since 1.5.1
 * @param string $user_login The user login name.
do_action( 'retrieve_password', $user_login );

 * Filter whether to allow a password to be reset.
 * @since 2.7.0
 * @param bool true           Whether to allow the password to be reset. Default true.
 * @param int  $user_data->ID The ID of the user attempting to reset a password.
$allow = apply_filters( 'allow_password_reset', true, $user_data->ID );

if ( ! $allow )
    return new WP_Error('no_password_reset', __('Password reset is not allowed for this user'));
else if ( is_wp_error($allow) )
    return $allow;

Above is part of the code taken from wp-login.php file. http://wpseek.com/retrieve_password/

  • great info, but can you please supply a small snippet of a code that actually should block password reset? this is not trivial for people which are not very familiar with using filters Dec 14, 2013 at 14:26
  • Updated my answer above. Dec 14, 2013 at 14:47
  • Thanks, Subharanjan. The code looks great! I'm away from the office now, but will try it out first thing Monday :-)
    – Chris
    Dec 14, 2013 at 16:01
  • 2
    Thanks, Subharanjan. Your code works perfectly :) One slight alteration was to make it check the email for the institution domain rather than a specific user: // check if the user a LDAP user if (strpos(strtolower($user_email),'domain') !== false) { return new WP_Error('no_password_reset', __('Password reset is not allowed for this LDAP user on this site.')); }
    – Chris
    Dec 16, 2013 at 8:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.