Remove forgotuserpassword.action - any unexpected consequences?

[Mike Buchanan]

We are on Confluence version 6.6.1.  Our users authenticate with a SAML plugin but their user accounts are in the internal directory.  However, we want them always to login with the SAML authentication.  Since they don't use the internal directory Confluence password, we have set them all to long random passwords for safety. 

I have hidden the Forgot password link on our wiki.net/login.action?nosso page using CSS but if they know the url - wiki.net/forgotuserpassword.action, they could still go and reset their password.

So, my question is, what would be the impact if we removed the forgotuserpassword.action page from our Confluence build?  Does that have the possibility of breaking something else?

Thanks!

[AnnWorley · Accepted solution]

I am not sure what method you would use to remove the forgotuserpassword.action page. If you just block it from the proxy it certainly won't impact the rest of the instance.

If you want to do a deeper hack to remove it, please try in a test instance first to avoid surprises in Production.

[Christian Reichert (resolution)]

Hi @Mike Buchanan,

to my knowledge when we tried it a long, long time ago, there was no negative impact we could see.

Cheers,
  Christian