# Feature OP-8538 - Consistent name and mail address changes for LDAP and SSO accounts | restrict account configuration options when account management system is used

Project: OpenProject
Status: new
URL: https://community.openproject.org/work_packages/OP-8538

## Planning

| Attribute | Value |
| --- | --- |
| Date |  |
| Priority | Medium |
| Target versions | Wish List |
| Sprint |  |
| Backlog bucket |  |
| Votes |  |
| List |  |
| Roadmap |  |
| Relevance |  |

## OPEN POINTS / FEEDBACK

_No work packages_

## Features and Chunks

_No work packages_

## Bugs and other work packages

_No work packages_

## Technical Details

| Attribute | Value |
| --- | --- |
| Module |  |
| Feature Flag |  |
| Requires doc change | Yes |
| Enterprise plan |  |

## Details

| Attribute | Value |
| --- | --- |
| Pull preview |  |
| Mockups |  |
| Found in mobile app version |  |
| Follow-up feedback e-mail |  |
| Accessibility | No |

## People

| Attribute | Value |
| --- | --- |
| Assignee |  |
| Accountable |  |
| Product manager |  |
| Developers |  |
| Designer |  |
| Ordered by |  |
| Signed off by |  |
| Interest by |  |

## Estimates and progress

| Attribute | Value |
| --- | --- |
| PD (min) |  |
| PD (max) |  |
| Work |  |
| Labor costs |  |

## Description

**As** a administrator of an OpenProject service bound to an LDAP or some other account management system  
**I want to**

1.  restrict changes of the account names and mail addresses by the users within OpenProject if an external account provider is used
2.  point the user to an external website (of the account provider or some other tooling) where he can change his account information
3.  have means to synchronise the account details in OpenProject and the external account provider if they have been changed externally.

**so that** the account details in OpenProject are always consistent

*   with the information provided by the account management system
*   and with any other service that is bound to the external credentials provider.

  

_Current behavior:_

Self-managed users and LDAP: the user can freely change his name and mail address. If LDAP is used, the account details are set with the first login. If the user chooses to change his details, they might deviate from the information stored in the credentials provider.

SSO accounts: the user can freely change his name, but not his mail address (text field for mail is disabled). User is not informed where and how he can modify the accounts mail address. If the user chooses to change his name information, this might deviate from the information stored in the credentials provider.

For the LDAP and SSO case, a name or email address changed in the account management system after the registration in OpenProject is never synchronised back to OP.

  

_Expected behaviour:_

Any account information (name, mail) is always synced between OP and the external credentials provider. As OP cannot trigger a change in a non-LDAP provider, idealy any account information is read-only in OP dialogs and the administrator can configure a link to the UI of the external provider to appear in those dialogs. So that the user is informed where to change his details for all services that use the same credentials provider.

If the account details are changed externally, OP should re-synchronize the details with each login. Alternatively, OP should allow administrators to trigger the account detail synchronisations by REST oder CLI.

  

**Acceptance criteria**

*   If LDAP or another SSO credential provider is used, user name details (prename, surname) and mail address should be read-only (currently, this is only for mail and only for SSO, but not LDAP).
*   If LDAP or another SSO credential provider is used, a link can optionally be shown on the edit user page for external providers. This link should be an administration setting.
*   Either: If LDAP or another SSO credential provider is used, user name details (prename, surname) and mail address should be refreshed with each login.
*   Or: administrators should be able to trigger synchronisation of the account details for all LDAP/SSO users (or a specific one) by REST oder CLI.