function readOnly(count){ }
Sign Up ›
Starting November 20, the site will be set to read-only. On December 4, 2023,
forum discussions will move to the Trailblazer Community.
Learn More

Browse by Topic
ShowAll Questionssorted byDate Posted
+ Start a Discussion
RedSalesRedSales 

Disable Reset Password Option On Profiles/Users?

Hello,

 

We are considering introducing SSO for our Salesforce.com implementation. Once this has been done it would be good if we can disable the options for users to reset their passwords within SFDC  (The passwords will be controlled externally to SFDC by our SSO identity provider.)

 

Do you know if it is posible to remove the possibility for a profile or user to change their passwords?

 

I note in the configuration settings for profiles there are 2 password options which can be activated/deactivated.

 

- "Password Never Expires"

- "Reset User Passwords and Unlock Users"

 

I presume option 2 above applies to all users who are assigned to the profile & not just the an indibidual user. Therefore if activated the profile user could reset every users password who is assigned to the profile?

 

On a User record it just displays the last date the password was changed "Last Password Change or Reset". There is an option for the user to go to "Personal Setup > My Personal Information > Change My Password" but I'd like to disable this.

 

Any help on this would be great.

 

Thanks!

Best Answer chosen by Admin (Salesforce Developers) 
sfdcfoxsfdcfox

Salesforce.com can't reset passwords that are external to itself, which is what I was basing my previous statement on; it'd be like trying to change your email password using Outlook. Any time salesforce.com can't control the password, it also can't reset the password. I presume that this means all manner of delegated logins, now and in the future, will probably (without a new SSO protocol that allows changing) be subject to this limitation.

All Answers

sfdcfoxsfdcfox

A user with SSO enabled can not reset their password through salesforce.com. Attempting to use Change Password, Reset Password, etc though all available channels will result in an error that states that they are unable to use the feature and must contact their IT department.
RedSalesRedSales

Thanks sfdcfox. Is this therefore a standard message that automatically comes up or is it something that is set by administrators for each company's instance of SFDC?

 

Thanks again!
sfdcfoxsfdcfox

It's not configurable, as far as I know. I haven't personally used SSO, but I understand it's fairly straight forward, assuming you have the software you need to implement SSO/Delegated Authentication. I saw it in action once, many years ago, and back then it was a standard message that advised the user to contact their IT department. They may have personalized it since then, such that it would show the actual name of the individual that they should contact. You should contact salesforce.com technical support and ask them. They should probably have the answer to that.
RedSalesRedSales

Thanks sfdcfox.  I'll leave the question open for now in case anyone else has any further input but your responses are very helpful & a good guide on how this should work.

 

 
RedSalesRedSales

Hello,

 

I note in the SSO implementation guide https://na1.salesforce.com/help/doc/en/salesforce_single_sign_on.pdf it states in the Frequently Asked Questions Section:

 

"How are passwords reset when single sign-on has been implemented?

- Password reset is disabled for single sign-on users who use delegated authentication because Salesforce.com no longer manages their passwords. Users who try to reset their passwords in Salesforce.com will be directed to their Salesforce.com administrator."
"Password reset is disabled for Single Sign-On users because Salesforce no longer manages their passwords. Users who try to reset their passwords in Salesforce will be directed to their Salesforce administrator."
Therefore the first paragraph I've posted specifically mentions Delegated SSO while the second one does not.
Is it correct therefore that the same process applies to SAML SSO configurations? I.e. If SAML is implemented then the the password reset button will just not work although it will still be displayed on the page layout. 
Thanks for the help.  I guess sfdcfox this may be what you were referring to above.

 
sfdcfoxsfdcfox

Salesforce.com can't reset passwords that are external to itself, which is what I was basing my previous statement on; it'd be like trying to change your email password using Outlook. Any time salesforce.com can't control the password, it also can't reset the password. I presume that this means all manner of delegated logins, now and in the future, will probably (without a new SSO protocol that allows changing) be subject to this limitation.

This was selected as the best answer
RedSalesRedSales

Thanks sfdcfox.
Rohan BRohan B

If you use federated SSO the user can still change their password.  Is there a way to stop this?