[Password Reset] Prevent reset requests for "social only" users

[mecampbellsoup]

In some cases, users in our application will have joined an existing organization via e.g. SAML configuration (a SocialApp), and thus user.has_usable_password is False and user.socialaccount_set contains 1 SocialAccount that was produced/persisted by way of signing up w/ the previously mentioned SAML SocialApp instance.

We are interested in enabling some configuration to our customers so they can say, "My organization's users should only be able to signup and login via this SAML application." Is there any existing configuration to enforce that, so included but not limited to:

• Not able to successfully submit a request for password reset;
• not able to successfully subsequently submit a password change;
• etc.

Currently it is possible for a user for whom user.has_usable_password is False to reset their password, and set a usable password, thereby allowing "local" login to their "social only" user account. (This is how our legacy app works, but in our new app we are making things more enterprise-focused and adding controls that give our customers more security features like enforcing SAML SSO authentication, etc.)

[pennersr]

There is no direct configuration for that, though you can easily override e.g. the ResetPasswordForm.clean_email() method to lookup the user from the email and handle things from there. There is also the adapter clean_password(self, password, user=None) method you can hookup to to reject moving from an unusable password.

I can imagine a allauth.policies sort of app at some future point in time handling account policies, including e.g. MFA restriction, but for now that's out of scope.

[mecampbellsoup]

you can easily override e.g. the ResetPasswordForm.clean_email() method to lookup the user from the email and handle things from there.

Will this work w/ headless endpoint as well? (I can of course play around and answer myself but wanted to include in this discussion for any future readers that may come along.) It looks like the answer is "yes" as the headless RequestPasswordResetInput inherits from ResetPasswordForm.