From 66f1b5e25ab5e8fc4f4facb04d98665ac7da9237 Mon Sep 17 00:00:00 2001
From: Larry Gregory <lgregorydev@gmail.com>
Date: Tue, 11 Dec 2018 07:35:31 -0500
Subject: [PATCH] Only show change password form when a password change is
 possible (#26779)

* only show change password form when a password change is possible

* cleanup

* remove test code

* improved message
---
 x-pack/plugins/security/common/constants.js               | 1 +
 x-pack/plugins/security/public/views/account/account.html | 7 +++++++
 x-pack/plugins/security/public/views/account/account.js   | 4 ++++
 3 files changed, 12 insertions(+)

diff --git a/x-pack/plugins/security/common/constants.js b/x-pack/plugins/security/common/constants.js
index a62085787cd47..bc74ebb4bfeec 100644
--- a/x-pack/plugins/security/common/constants.js
+++ b/x-pack/plugins/security/common/constants.js
@@ -6,3 +6,4 @@
 
 export const GLOBAL_RESOURCE = '*';
 export const IGNORED_TYPES = ['space'];
+export const REALMS_ELIGIBLE_FOR_PASSWORD_CHANGE = ['reserved', 'native'];
\ No newline at end of file
diff --git a/x-pack/plugins/security/public/views/account/account.html b/x-pack/plugins/security/public/views/account/account.html
index 5df3ded202600..f56921a3d50f8 100644
--- a/x-pack/plugins/security/public/views/account/account.html
+++ b/x-pack/plugins/security/public/views/account/account.html
@@ -52,7 +52,14 @@
   </div>
 
   <!-- Change password -->
+  <div class="kuiFormSection" ng-if="!showChangePassword">
+    <label class="kuiFormLabel" i18n-id="xpack.security.account.passwordLabel" i18n-default-message="Password"></label>
+    <div class="euiText">
+      <p i18n-id="xpack.security.account.changePasswordNotSupportedText"  i18n-default-message="You cannot change the password for this account."></p>
+    </div>
+  </div>
   <kbn-change-password-form
+    ng-if="showChangePassword"
     require-current-password="true"
     show-kibana-warning="user.metadata._reserved && user.username === 'kibana'"
     on-change-password="saveNewPassword(newPassword, currentPassword, onSuccess, onIncorrectPassword)"
diff --git a/x-pack/plugins/security/public/views/account/account.js b/x-pack/plugins/security/public/views/account/account.js
index f4c0fdbbd7889..e20fe609f9aae 100644
--- a/x-pack/plugins/security/public/views/account/account.js
+++ b/x-pack/plugins/security/public/views/account/account.js
@@ -11,6 +11,7 @@ import template from './account.html';
 import '../management/change_password_form/change_password_form';
 import '../../services/shield_user';
 import { i18n } from '@kbn/i18n';
+import { REALMS_ELIGIBLE_FOR_PASSWORD_CHANGE } from '../../../common/constants';
 
 routes.when('/account', {
   template,
@@ -33,6 +34,9 @@ routes.when('/account', {
 
     const notifier = new Notifier();
 
+    const { authentication_realm: authenticationRealm } = $scope.user;
+    $scope.showChangePassword = REALMS_ELIGIBLE_FOR_PASSWORD_CHANGE.includes(authenticationRealm.type);
+
     $scope.saveNewPassword = (newPassword, currentPassword, onSuccess, onIncorrectPassword) => {
       $scope.user.newPassword = newPassword;
       if (currentPassword) {