Password changing in Confluence
Asked by Jo:

Hi,

how should I configure our Confluence so that a password change option would be available to the normal users?


Answers:
author: Sabine Winkler
body: Hi,

usually, it is allowed to change the password for users \[1\]. But maybe something changed in your configuration. I guess a normal user means !administrator, right?

Another way is using the "Forgot Password" option on the Login Screen. Can please provide more details about the current state of your Confluence configuration?

HTH, Sabine

\[1\] <https://confluence.atlassian.com/display/DOC/Changing+Password>

comments: author: Jo
body: I've read the documentation before posting here, but I don't have the option to change password if I follow that path. .When I try to use the "forgot password option, this is what I get :http://awesomescreenshot.com/0f4300vafa

Re "normal user" = user without admin rights.

The Confluence version we are using is 5.1 .


author: Sabine Winkler
body: Hi,

is this a new Confluence installation? Or has already someone changed something. The screen you provided exactly shows what a former tutorial described for disabling a password. \[1\]

Maybe you can upload the \<confluence_install\>\\confluence\\users\\changemypassword.vm

to review if this is why you are getting this error?

HTH, Sabine

\[1\] <https://confluence.atlassian.com/display/CONFKB/How+to+Disable+Users+from+Changing+Their+Password>


author: Jo
body: This is an old install, it's been in place since last year; I think one of the previous administrators disabled the possibility for users to change their passwords, so I am trying to fix that. How do I access / Where do I look for\<confluence_install\>\\confluence\\users\\changemypassword.vm ?


author: Sabine Winkler
body: Hi,

go to your confluence installation directory - navigate confluence\\users\\ Inside this directory you should find the velocity file changemypassword.vm. Here you can remove the changes a previous administrator made.

HTH, Sabine


author: Jo
body: This is what I see in my Velocity template..

\<html\>

\<head\>

\<title\>$generalUtil.htmlEncode($pageTitle)\</title\>

#requireResource("confluence.web.resources:aui-forms")

\</head\>

#applyDecorator("root")

#decoratorParam("context" "profile")

#decoratorParam("mode" "edit-profile")

#decoratorParam("helper" $action.helper)

\<body\>

#if ($settingsManager.getGlobalSettings().isExternalUserManagement())

$action.getText("cannot.change.password.users.outside")

#elseif(!$userAccessor.isReadOnly($remoteUser))

#applyDecorator("form-aui")

#decoratorParam("formName" "changepassword")

#decoratorParam("submitAction" "dochangemypassword.action")

#decoratorParam("editAction" "changemypassword.action")

#decoratorParam("editMode" "$editMode")

#decoratorParam("saveValue" "Save")

\<h2\>$action.getText("change.password")\</h2\>

\<fieldset\>

#assistiveLegend("accessibility.profile.password")

#bodytag( "Password" "label='cur.pass.name'" "name='currentPassword'" "theme='aui'")

#param("required" "$action.getText('required.field')")

#end

#bodytag( "Password" "label='new.pass.name'" "name='newPassword'" "theme='aui'")

#param("required" "$action.getText('required.field')")

#end

#bodytag( "Password" "label='new.pass.confirm.name'" "name='newPasswordConfirmation'" "theme='aui'")

#param("required" "$action.getText('required.field')")

#end

\</fieldset\>

#form_xsrfToken()

#tag( "Submit" "theme='aui'")

#end

#end

\</body\>

#end

\</html\>

Not sure what I need to change here to re-enable the passoword change option. Could you please advise?


author: Sabine Winkler
body: Hi,

I compared your file with the original file and found no differences. But there is another hint in the file itself:

#if ($settingsManager.getGlobalSettings().isExternalUserManagement())

If your Confluence uses an external User Management (e.g. LDAP) it will print out the message that you cannot change your password within Confluence. Is your Confluence using this?

I only found one comment in the JIRA documentation here \[1\]

*If your JIRA administrator has configured the user directory containing your account with external password management, the '**Change Password** ' link will not be available.*

\[1\] <https://confluence.atlassian.com/display/JIRA/Changing+your+Password>


author: Jo
body: I almost fixed it ( i think ). Now I can see the "Change password" but only for the Admin account, not for regular users. \>.\< I've disabled the external user management and I also moved the #form_xsrfToken() above h2.

\<html\>

\<head\>

\<title\>$generalUtil.htmlEncode($pageTitle)\</title\>

#requireResource("confluence.web.resources:aui-forms")

\</head\>

#applyDecorator("root")

#decoratorParam("context" "profile")

#decoratorParam("mode" "edit-profile")

#decoratorParam("helper" $action.helper)

\<body\>

#if ($settingsManager.getGlobalSettings().isExternalUserManagement())

$action.getText("cannot.change.password.users.outside")

#elseif(!$userAccessor.isReadOnly($remoteUser))

#applyDecorator("form-aui")

#decoratorParam("formName" "changepassword")

#decoratorParam("submitAction" "dochangemypassword.action")

#decoratorParam("editAction" "changemypassword.action")

#decoratorParam("editMode" "$editMode")

#decoratorParam("saveValue" "Save")

#form_xsrfToken()

\<h2\>$action.getText("change.password")\</h2\>

\<fieldset\>

#assistiveLegend("accessibility.profile.password")

#bodytag( "Password" "label='cur.pass.name'" "name='currentPassword'" "theme='aui'")

#param("required" "$action.getText('required.field')")

#end

#bodytag( "Password" "label='new.pass.name'" "name='newPassword'" "theme='aui'")

#param("required" "$action.getText('required.field')")

#end

#bodytag( "Password" "label='new.pass.confirm.name'" "name='newPasswordConfirmation'" "theme='aui'")

#param("required" "$action.getText('required.field')")

#end

\</fieldset\>

#tag( "Submit" "theme='aui'")

#end

#end

\</body\>

#end

\</html\>


author: Jo
body: I haven't moved the changemypassowrd.vm file from C:\\Java\\Confluence\\confluence\\users where I've found it to start with. Should I move it somewhere else?


author: Sabine Winkler
body: Hi,

theoretically it should work if you disabled external user management. Have you restartet Confluence after disabling? As far as I can see there is no check for being an administrator. The only check is

#elseif(!$userAccessor.isReadOnly($remoteUser))

If you have time I would recommend to

1. Stop Confluence
2. Take the original changemypassword.vm and store it in the right location
3. Start Confluence
   1. Check, if the user management setting is still not set to external
4. Check, if the already existing users have a dependency because of their origin (from the external user management) - maybe this causes "read-only"
5. Create a new user (!administrator) and test, if this user is able to change the password as expected. If so, the behaviour might be related to the existing users (formerly from external user management)

HTH, Sabine


author: Sabine Winkler
body: Sorry, I wasn't clear at this point. I meant if you have saved the original file please move it back. If the original file is still in the directory everything is fine.


author: Jo
body: Thank you very much. I will do the restart tonight as plenty of my colleagues are still working in Confluence atm. I will let you know how it turned out after that.


author: Jo
body: i've gone through the steps you've recomdend. the only difference I could spot is that my new test user is a member of the confluence directory whereas the rest of the users are members of crowd. is there some way to allow these users to change their own passwords from Confluence?


author: Sabine Winkler
body: Hi,

at this point I think I cannot help you so much anymore because I was never working with the Crowd Management - maybe this \[1\] will help you to check permission settings in the crowd, because this seems to be the point where applications like Confluence get the right to change e.q. user etc.

HTH Sabine

\[1\] [https://confluence.atlassian.com/display/CROWD/Specifying+an+Application%27s+Directory+Permissions](https://confluence.atlassian.com/display/CROWD/Specifying+an+Application%2527s+Directory+Permissions)


author: Jo
body: This is an old install, it's been in place since last year; I think one of the previous administrators disabled the possibility for users to change their passwords, so I am trying to fix that. How do I access / Where do I look for \<confluence_install\>\\confluence\\users\\changemypassword.vm ?


Tags: change

password