# Feature OP-14487 - Disable name and email fields in user profile for LDAP user

Project: OpenProject
Status: closed
URL: https://community.openproject.org/work_packages/OP-14487

## Planning

| Attribute | Value |
| --- | --- |
| Date |  |
| Priority | Medium |
| Target versions | 14.0.0 |
| Sprint | 14.0.0 |
| Backlog bucket |  |
| Votes |  |
| List |  |
| Roadmap |  |
| Relevance |  |

## OPEN POINTS / FEEDBACK

_No work packages_

## Features and Chunks

_No work packages_

## Bugs and other work packages

_No work packages_

## Technical Details

| Attribute | Value |
| --- | --- |
| Module |  |
| Feature Flag |  |
| Requires doc change | Yes |
| Enterprise plan |  |

## Details

| Attribute | Value |
| --- | --- |
| Pull preview |  |
| Mockups |  |
| Found in mobile app version |  |
| Follow-up feedback e-mail |  |
| Accessibility | No |

## People

| Attribute | Value |
| --- | --- |
| Assignee |  |
| Accountable |  |
| Product manager |  |
| Developers | Community Contributor |
| Designer |  |
| Ordered by |  |
| Signed off by |  |
| Interest by |  |

## Estimates and progress

| Attribute | Value |
| --- | --- |
| PD (min) |  |
| PD (max) |  |
| Work |  |
| Labor costs |  |

## Description

Most of our users use LDAP authentication which fills in the name and email. However, **users can later change it on their Profile but we want to prevent that** because the changed name causes chaos and confusion to other users.

**Acceptance criteria**

  - Users authenticated by LDAP cannot change their name and email. Their attributes are synced daily anyway, it doesn't make sense to allow such a change.
  - ~~This requirement likely needs to be optional, either globally for all LDAP sources or per LDAP source (a bit more complicated but more flexible). This can be achieved even without Admin UI changes if the environment variable flag is used.~~

We (Evolveum) would gladly contribute this feature, I just need some feedback on what is acceptable for you. The profile page for an LDAP user could look like this (normally admin is not an LDAP user, of course, this is just a demo):  
<img class="op-uc-image op-uc-image_inline" src="/api/v3/attachments/93568/content">

~~As for Admin UI, there could be an option such as "Read-only name and email for LDAP users" either on /admin/settings/users or /admin/settings/authentication or per LDAP, e.g. /admin/ldap\_auth\_sources/1/edit~~

~~If acceptable, I'd prefer that environment variable flag, but I'll let you decide.~~