I'm working on a single-sign-on module for D8 and would like to disable the password fields on the user edit form, since passwords should be managed by the outside identity provider and not through Drupal.
Drupal adds a "current password" field to the edit page which is required if the user wants to change their email address. I can remove the field easily in a hook_form_alter, but there's a form constraint,
ProtectedUserFieldConstraintValidator, that runs and fails validation if the password field is not filled out.
How can I remove this form constraint dynamically?
Things I've looked at so far:
- In my hook_form_alter setting
$form_state->getFormObject()->getEntity()->_skipProtectedUserFieldConstraint = TRUE. This is a property that this constraint checks and when TRUE will skip it, but changes to the entity here are tossed since
ContentEntityForm::validateFormrebuilds the entity just before validation.
- Looking at the
BaseFieldDefinitionclass to see if there's a way to remove an existing constraint, but there are no API methods available to do so.
EDIT: It seems once possible approach is to extend
ProfileForm, overwrite the
buildEntity method to set
_skipProtectedUserFieldConstraint = TRUE, and then tell core to use my forms instead. Thought a downside here is that I'm just disabling the constraint in the context of a form, but not in other contexts where the entity may be updated, like in a REST API.