My site requires that I turn off the current password validation on the Account Edit Form when changing / specifying a new password.

In D7 I accomplished this via a hook_form_alter implementation. With Drupal 8's new form api I am unsure of how I can make this alteration. hook_form_alter still exists, but the values in the form[#validation] seems to be used differently.

I see in the existing form code that a 'password reset' does exactly what I would like to do, but it's unclear how I can make this modification outside the actual AccountForm Class, or the ProtectedUserFieldConstraintValidator implementation of ConstraintValidator.


  • Why would your site require that? You know it's a security risk, right?
    – Mołot
    Sep 10, 2015 at 15:08
  • 1
    Of course in general you wouldn't want to do this. I am however writing a Federated login module that externally authenticates. And without going into great detail, being able to change / create a password is part of the functionality required. Sep 10, 2015 at 15:27

2 Answers 2


$account->_skipProtectedUserFieldConstraint is a flag that is designed to prevent this validation.

The trick is setting it at the right place. Not exactly sure what works, since the code in AccountForm::buildEntity() always sets it to either TRUE or FALSE. Maybe we need to change that to only set it to TRUE if it's TRUE and not force it to FALSE. Then you could use an entity builder callback (see the last line in menu_ui_form_node_type_form_alter() for an example).

What you can try is setting $form_state->set('user_pass_reset', TRUE) altough that could possibly have side effects.

  • Thanks so much, let me investigate the info you provided and I'll let you know what happens. Sep 11, 2015 at 14:42
  • I think setting user_pass_reset works well enough. Maybe not ideal since it wasn't meant for this. But good enough for now I believe. Like you said, making that flag in AccountForm more flexible would be a nice enhancement. A lower priority one though. Sep 11, 2015 at 18:28

A working code example for this is the No Current Password module.

Here's the relevant code:

 * Implements hook_form_FORM_ID_alter().
 * Remove the current password field from the user_profile_form form (user/%/edit).
function nocurrent_pass_form_user_form_alter(&$form, &$form_state) {

  // Get the module's configuration
  $config = \Drupal::config('nocurrent_pass.settings');
  $nocurrent_pass_disabled = $config->get('nocurrent_pass_disabled');

  // If the Current password is disabled
  if ($nocurrent_pass_disabled) {

    $account = \Drupal::service('current_route_match')->getParameter('user');

    // If this is not the Superadmin's edit page
    if ( !empty($account) && ($account->id() != 1) ) {

      // Turn off Current password field's validation
      $form_state->set('user_pass_reset', 1);

      // Hide the Current password fields
      $form['account']['current_pass']['#access'] = FALSE;

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.