Hello,
I am using Seafile Server Pro 13.0.25 with users synchronized via LDAP.
Since I use LDAP, I set the value “enable_change_password=false” in the “seahub_settings.py” file.
Now I’ve added a new Seafile-only user via the admin page (not via LDAP). The user received an invitation email along with the initial password.
On their first visit using this generated password, they are redirected to change their password. However, on this page, only the full-screen message “Password cannot be changed” (displayed in German).
They cannot leave this page! They also cannot log in again with different credentials.
In my test case, to log in again as the admin user, I first had to clear my browser cookies!
To test this, I set “enable_change_password=true” and selected the “Reset Password” option on the admin page. Here, too, strange behavior occurs. The user receives a link to reset the password. They follow this link and can set a new password. The next time they log in with this new password, the user is prompted to change it again.
After that, they are finally taken to the 2FA token page, and the process is finally complete.
How to configure seafile correctly to forbid ldap users to change its passwords and allow new users to change their first time password on first login - or even reset is?