21 May 2013, 16:07

We are running Mahara 1.4.6 with SSO with Moodle 2.3.3 and for some strange reason users are being prompted to update their password when they SSO to Mahara.

The strange thing is, when you fil in the text field it is actually updating the users Display name rather than their password.  We don't actually want to update the password as we are SSO'ing onto Mahara so we have other systems that deal with the password updates on Moodle.  Furthermore it is becoming a bit of a security risk as people are putting their password in and other users can spot it by viewing their display name.

Any ideas why this is happening?  Is this a bug or a setting we have inadvertently enabled? 

Appreciate any pointers you can give me

09 June 2013, 18:32

Hello Daniel,

Did you make any changes to your Mahara site? I've never come across this message in connection with the display name. Is MNet the only authentication method or do you have another one for that Mahara institution as well? I'm grasping at straws a bit as I can't see your installation to know what might be going on.

Did you lock the "Display name" in Mahara (on the institution settings screen under "Locked fields" and also check under "No institution")? Normally, you are asked for a field such as the display name if it is a required field, but that should not be coupled with the text to change your password. Something strange is going on and any additional information about your instance, settings, customizations might help to shed a light.

Cheers

Kristina

10 June 2013, 17:25

Hi Daniel,

Actually, I just saw a very similar issue pop up in the Mahara Moodle forum: https://mahara.org/interaction/forum/topic.php?id=5422&offset=0#post23383

Probably, your SSO isn't supplying one of the required fields for new user accounts, and so it's redirecting you to the page that asks for that. However, that page is the same page template that's used for password resets, and the text in the header only talks about passwords. (We should probably file a bug about this.)

Although in that other post, I identified firstname, lastname, and email as the required fields, not displayname...

Cheers,
Aaron

10 June 2013, 21:43

Hi Aaron and Daniel,

I couldn't find how Moodle would be asking for the display name as that is unique to Mahara. The only possibility was that the display name field is locked, but that just means that people can't fill it in. This wouldn't prompt the instance to require it though. I tested this on a Moodle - Mahara connection yesterday and couldn't replicate the problem Daniel was seeing. Right now my only guess would be that the display name was made a required field in Daniel's instance and thus it's being asked for (with the wrong template page around it).

Cheers

Kristina

11 June 2013, 15:48

Hi Aaron and Kristina,

thanks for your responses.

I have since adjusted a few settings, unlocked the display name fields and unchecked the option to update user info on login.

I'll keep an eye on it and see what happens and let you know.

Cheers

Dan

13 June 2013, 21:06

Hello Dan,

So you did have the display name field locked?

As for the updating of the user info on login: That should not have triggered the screen you saw. We have that turned on for many Mahoodle installs because it allows you to keep names etc. in sync from Moodle, and I've never seen your screen when that setting was turned on.

Cheers

Kristina