From d7c6d204835a4855c5e260305a132cab16dc28e4 Mon Sep 17 00:00:00 2001
From: Moritz <moritz.m@local-it.org>
Date: Wed, 4 Feb 2026 11:07:01 +0100
Subject: [PATCH] User form: red warning for OIDC users when setting/changing
 password

- Show alert when user has oidc_id and password section is visible.
- Explains that password here does not change SSO/identity provider password.
---
 lib/mv_web/live/user_live/form.ex | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/lib/mv_web/live/user_live/form.ex b/lib/mv_web/live/user_live/form.ex
index 72d4741..46e23b3 100644
--- a/lib/mv_web/live/user_live/form.ex
+++ b/lib/mv_web/live/user_live/form.ex
@@ -81,6 +81,18 @@ defmodule MvWeb.UserLive.Form do
 
           <%= if @show_password_fields do %>
             <div class="p-4 mt-4 space-y-4 rounded-lg bg-gray-50">
+              <%= if @user && MvWeb.Helpers.UserHelpers.has_oidc?(@user) do %>
+                <div class="p-3 mb-4 border border-red-300 rounded-lg bg-red-50" role="alert">
+                  <p class="text-sm font-semibold text-red-800">
+                    {gettext("SSO / OIDC user")}
+                  </p>
+                  <p class="mt-1 text-sm text-red-700">
+                    {gettext(
+                      "This user is linked via SSO (Single Sign-On). A password set or changed here only affects login with email and password in this application. It does not change the password in your identity provider (e.g. Authentik). To change the SSO password, use the identity provider or your organization's IT."
+                    )}
+                  </p>
+                </div>
+              <% end %>
               <.input
                 field={@form[:password]}
                 label={gettext("Password")}